0% found this document useful (0 votes)
17 views9 pages

Log-Based Intrusion Detection System

The paper discusses the development of a host-based intrusion detection system (HIDS) that utilizes logs generated by services on computer systems to detect intrusions and misuse. It highlights the importance of log analysis in identifying potential security threats and the challenges posed by the variety of log formats in large networks. The proposed HIDS aims to improve security monitoring and compliance by analyzing system logs and providing alerts for suspicious activities.

Uploaded by

kouraa355
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd
0% found this document useful (0 votes)
17 views9 pages

Log-Based Intrusion Detection System

The paper discusses the development of a host-based intrusion detection system (HIDS) that utilizes logs generated by services on computer systems to detect intrusions and misuse. It highlights the importance of log analysis in identifying potential security threats and the challenges posed by the variety of log formats in large networks. The proposed HIDS aims to improve security monitoring and compliance by analyzing system logs and providing alerts for suspicious activities.

Uploaded by

kouraa355
Copyright
© All Rights Reserved
We take content rights seriously. If you suspect this is your content, claim it here.
Available Formats
Download as PDF, TXT or read online on Scribd

See discussions, stats, and author profiles for this publication at: [Link]

net/publication/342353650

Log Based Intrusion Detection System

Conference Paper · September 2018


DOI: 10.9790/0661-2005011522

CITATIONS READS

2 5,358

1 author:

Umesh Raut
MIT World Peace University
18 PUBLICATIONS 37 CITATIONS

SEE PROFILE

All content following this page was uploaded by Umesh Raut on 18 July 2020.

The user has requested enhancement of the downloaded file.


IOSR Journal of Computer Engineering (IOSR-JCE)
e-ISSN: 2278-0661,p-ISSN: 2278-8727, Volume 20, Issue 5, Ver. I (Sep - Oct 2018), PP 15-22
[Link]

Log Based Intrusion Detection System


Umesh K. Raut1
1
(Computer Engineering, MIT Pune, India)

Abstract: The idea of making everything readily available and universally has led to a revolution in the field of
networks. In spite of the tremendous growth of technologies in the field of networks and information, we still
lack in preventing our resources from cyber-attacks. This may not concern small organizations but it is a
serious issue as far as industries, companies or national securities are concerned. Since many different
mechanisms were opted by organizations in the form of intrusion detection and prevention systems to protect
themselves from these kinds of attacks, there are many security breaches which go undetected. A host-based
intrusion detection system (HIDS) is a system that monitors a computer system on which it is installed to detect
an intrusion and/or misuse, and responds by logging the activity and notifying the designated authority. In this
paper, we develop a HIDS using logs generated by services running on the systems. We will discuss about the
client-server architecture used in HIDS.
Index Terms: IDS, HIDS, security, threat detection, log analysis
---------------------------------------------------------------------------------------------------------------------------------------
Date of Submission: 29-08-2018 Date of acceptance: 13-09-2018
--------------------------------------------------------------------------------------------------------------------------------- ------

I. Introduction
A log file is a file that records either events that occur in an operating system or other applications or it
is a message between different users of a communication software. Almost every software running on the
system generates logs, mostly for debugging purposes. A log is generated whenever an activity occurs in the
software. These logs can be used for different purposes. The logs can be used as a forensic evidence, audit trials
or to understand how the system behave after certain input. Recognizing the importance of logs, the National
Institute of Standards and Technology, USA issued best practices and recommendations for computer security
log management [2]. Current generation log analyzers work well with logs from know applications. They are
able to parse and interpret logs from know formats but fail to parse logs from a new application or a different
and unknown source. It is important to parse logs appropriately in order to use them later.
Log files provide vital information about systems and the activities occurring on them. For instance,
database logs can help trace how data was added and modified, while web server logs reveal patterns of how
resources are accessed from the Web. Analyzing log files can provide valuable insights into system
configurations as well as potential vulnerabilities. It is possible to use this information pro-actively to secure a
system against potential malicious activities.
Large company networks consists of a variety of software, including security software, running on
multiple hardware devices generating multiple log files. The logs generated daily by these devices is massive.
Traditional log file analyzers rely on knowing the format of the file. Existing tools either focus on a specific
type of log file or several but a fixed set of log types. Log files typically lack a common format with each log
encoding data in its unique and often proprietary style. It is even more difficult to keep track of log file formats
in large heterogeneous networks in which software and devices are dynamic in nature; often new software and
hardware are added to the network, each generating a log file with a unique schema. Existing approaches
designed to deal with a fixed number of log files thus fail to scale in such scenarios.
Recently cyber-attacks have been fairly sophisticated affecting different parts and applications as well
as several systems simultaneously and are carried out over a period of several days. Detecting and preventing
such low and slow vector attacks would require to generate a holistic view rather than analyzing each log
individually. Threat detection in dynamically adapting scenarios requires integrating data from multiple
traditional and non-traditional sources.

Figure 1: Sample web logs

DOI: 10.9790/0661-2005011522 [Link] 15 | Page


Log Based Intrusion Detection System

We present an approach that infers the structure and the schema of the log file and uses the schema to
generate semantic representation of the log file content. Consider the example web server log in figure 1. Each
line in the log file records the same type information for a fixed set of fields. In our example, each line is
recording IP address of the requesting host, time of request, requested resource, etc. We use this information by
splitting it into distinct columns, with each column consisting of similar type of values. For example, the web
server log can be split into columns such as requesting IP address, requested resource and so on.
Organizations are facing an increasing number of threats everyday in the form of viruses, malware,
intrusions, etc. Since many different mechanisms were opted by organizations in the form of intrusion detection
and prevention systems to protect themselves from these kinds of attacks, there are many security breaches
which go undetected.
A HIDS is to prevent the host system from being com-promised by intruders. To prevent the execution
of malicious codes on the host, HIDS monitors the system audit and event logs.
A HIDS is used for security detection, visibility, and compliance monitoring. It's based on a multi-
platform agent that forwards system data (e.g log messages, file hashes, and detected anomalies) to a central
manager, where it is further analyzed and processed, resulting in security alerts. Agents convey event data to the
central manager via a secure and authenticated channel.

II. Literature Survey


A literature survey represents a study of previously existing material on the topic of the paper.
 Existing theories about the topic which are accepted universally.
 Books written on the topic, both generic and specific.
 Research done in the field usually in the order of oldest to latest.
 Challenges being faced and ongoing work, if available.
The literature survey should be structured in such a way as to logically represent the development of ideas in
that field.
[1] In this paper, the author describes the logs generated by intrusion detection systems, web servers, anti-virus
and anti-malware systems, firewalls and network devices are usually intended for diagnostic and de-bugging
purposes, but their data can be extremely useful in system audits and forensic investigations.
[2] This paper describes a framework that can process any log file with unknown source and format, and
automatically generate a semantic interpretation of both its schema and contents in the form of RDF linked data
triples. They develop a splitting algorithm which can successfully generate a table like structure for log files.
They also extended existing techniques to successfully annotate every column in a log file with a semantic class
and map selected pairs of column to relation from the given ontology.
[3] Joshi describe an automatic framework that generates and publishes a RDF linked data representation of
cyber-security concepts and vulnerability descriptions extracted from several structured vulnerability databases
and unstructured text. This linked data collection was intended for vulnerability identification and to support
mitigation efforts. The prime idea was to leverage the Linked Data representation of vulnerability databases to
detect and prevent potential zero day attacks.
[4] In the area of "Log analysis", Nascimento use ontologies to analyze security logs. They create an ontology
model from the Modsecurity logs and demonstrated that it was easier to find co-relations of events in log files
when they were modelled using their ontology.
[6] Splunk is a enterprise log analysis and management tool developed to analyze a large corpus of logs of logs
providing features such as searching, management, storage and visualization. It analyzes structured and
unstructured log files and identifies fields in a given log file. It works well with log files whose structure it
already knows. It is able to split a log file into fields, but fails to generate headers for log files from unknown
sources.
[9] To prevent the execution of malicious codes on the host, HIDS monitors the system audit and event logs. But
the design of HIDS is very challenging due to the presence of high false alarm rate. This paper mainly focuses
on reducing the problem of false alarm rate, using semantic based system call patterns. This paper make use of
the semantic approach to apply on the underlying kernel level system calls which can help understand the
anomaly behavior. In this concept, the semantic approach is applied on the system call patterns for detecting the
intrusion on the host system using ADFA-LD dataset. The decision engine used is the ELM, which is well
known for its high learning speed and it requires only one time training. But the cost of processing time is high.
[10] In this paper they have made a survey on the overall progress of intrusion detection systems. They had done
survey of the existing types, techniques and architectures of Intrusion Detection Systems in the literature. This
survey paper gives a description of some intrusion detection approaches based on two basic techniques. Some
approaches work better in one environment but then prove to be weak in other environments. The approaches
discussed in this paper includes Statistical Models, Data Mining Based Methods, Signature analysis, Rule based
systems, Genetic Algorithms etc.

DOI: 10.9790/0661-2005011522 [Link] 16 | Page


Log Based Intrusion Detection System

[11] Host Intrusion Detection Systems (HIDS) have recently gained a noticeable amount of interest. These
defensive systems detect malicious activities on host-based applications. This paper reviews types of
architecture in intrusion detection systems and describes a threat-aware HIDS architecture model. In this paper,
they have reviewed traditional Intrusion De-tection architectures and then proposed an HIDS architecture
model. Some of the significant components in this model are: Dispatcher; according to its policy distributes the
input traffic to the analyzers. This, could affect on detection time and accuracy. Equalizer; necessitates in host
web application data, which supports data normalization. Correlation engine; responsible to reduce the total
number of alerts and messages that need to be observed by the system administrator to as few as possible by
merging similar events into groups.
[12] Most existing solutions for detecting these attacks use log analysis, and employ either pattern matching or
machine learning methods. This paper proposes a multi-stage log analy-sis architecture, which combines both
pattern matching and su-pervised machine learning methods. It uses logs generated by the application during
attacks to effectively detect attacks and to help preventing future attacks. The architecture is described in detail;
a proof-of-concept prototype is implemented and hosted on Amazon AWS, using Kibana for pattern matching
and Bayes Net for machine learning. Experiment results have shown that the two-stage system is able to detect
significantly more SQL injections that a single-stage system. When Bayes Net model (a supervised machine
learning method) precedes Kibana (a pattern matching sys-tem), the combined system has achieved the best
result. Since Kibana provides the final output with visualization, it is easy for analysts to further understand,
interpret, and take further actions.
[13] Intrusion Detection System (IDS) and Intrusion Pre-vention System (IPS) are the standard measures to
secure computing resources mostly in a network. They are deployed in a network for assuring an intrusion free
computing envi-ronment. This paper discusses the two technologies in details, their functionality, their
performances and their effectiveness to stop the malicious activity over a computer network. Having IPS and
IDS technologies are only two of many resources that can be deployed to increase visibility and control within a
corporate computing environment. IDS and IPS are to provide a foundation of technology that meets the
requirement of tracking, identifying network attacks to which detect through logs of IDS systems and prevent an
action through IPS systems. If the host is with critical systems, confidential data and strict compliance
regulations, then its a great to use IDS, IPS or both in network environments.
[14] The human labeling of the accessible network audit information instances is generally tedious, expensive as
well as time consuming. This paper focuses on study of existing intrusion detection task by using data mining
techniques and discussing on various issues in existing intrusion detection system (IDS) based on data mining
techniques. The data mining techniques that were discussed in this paper are K-Means, ID3 (Iterative
Dichotomiser 3), Naive Bayes, K-NN (K-Nearest Neighbour).

III. Intrusion Detection System


In today’s booming e-commerce economy age, virtually every business is connected to compete for
market share in the cyberspace. Enterprise’s networked systems are inevitably exposed to the increasing threats
from the external hackers as well as from internal. The consequences can be loss or modification of critical
business data, disruption of services (availability), compromise of proprietary business plans or processes
(confidentiality and integrity).
To counter these threats, information security organization has deployed many methods, tools and
technology to defend the legitimacy of the systems. Methods like implementing policies and procedure, user
awareness, deploying firewall and authentication systems, control systems access contain, eradicate recover and
serve as a lesson learnt.
We examine IDS, one of the relative new technologies in information security. It aims to explore, in
high level, the intrusion detections systems available today, as well as new developments in the technology.
At its core, IDS for computer network systems resemble burglar alarm systems to a physical building,
it is capable of detecting and alerting the systems administrator on potential intrusion, providing guidance
against any potential loss of integrity and confidentiality to the enterprise’s valuable intellectual assets.
Firewalls and authentication are effective in protecting and preventing unauthorized access to the
systems but lacks capabilities to monitor the network traffic where majority of attacks are taking place. These
attacks could be initiated by disgruntled employees and others who have legitimate network access and use that
privilege to do harm.
Firewall and authentication systems are vital, but they work at the point of entry to the network, if an
attack able to breach the firewall, he can roam freely throughout the whole network. To keep a constant eye on
network traffic and to know anything out of ordinary is happening, network security should be supplemented
with IDS.
IDS can be active or a passive IDS. Using an active IDS, suspected attacks are automatically blocked,
based on pre-programmed rules. This type of IDS is also referred to as intrusion detection and prevention

DOI: 10.9790/0661-2005011522 [Link] 17 | Page


Log Based Intrusion Detection System

system (IDPS). IDPS offers real-time protection whereas passive IDS only monitors the activities, logs the
suspected activities and reports it to the administrator for action.
These are the two ways intrusion detection works. IDS is host based, network based or the hybrids of
the two. Each type of the intrusion detection systems has its own merits and legitimate shortcoming. Regardless
of the type of systems deployed, it should include the following key features:
 Robust: IDS is expected to run continually in the background without human intervention, it should also be
fault tolerant, meaning that in the event of a crash or failure the product won’t have to be rebuilt or
reconfigured. It should remain impervious to attacks.
 Flexibility and Scalability: IDS should be configurable and is flexible in response to changes on the
network environment, it should also be able to cope with the growth of the network traffic while
maintaining fairly high accuracy in performance (scalable).
 Easy of use: IDS is to be managed without consuming too much of bandwidth or high overhead from the
organization. However, balance should be sought between ease of use and system effectiveness. In a real
situation, it requires considerable resources to manage and operate the devices.

A. Host-based IDS:
Host based IDS typically reside in the hosts they are monitored, the system agent will record important
system file attributes, including hashes of the files. The agent will periodically scan log files for anomalous
activity and notify the system administrator if they have detected suspicious pattern of systems access on the
hosts. Another host-based approach monitors all packets as they enter and exit the host, just like a personal
firewall.
Host based IDS is popular in that it can tell you if an attack actually happened and if it is significant
enough to warrant action. For example the IDS can detect changes in system files and knows if someone tries to
install potentially malicious software such as back doors. Back doors are highly specialized programs that let
hackers remotely control a server and either steal information from or modify it in a harmful way.
Also, the host is the best location to any attacks. It can also get a fine granularity of information, such
as who is accessing what files and when the users log in and out of servers. It is appropriate for protecting and
individual computer systems and the information it contains. However, it doesn’t provide data on the network as
a whole. Also the security systems take on considerable processing resource of the host (CPU, RAM and
storage).

B. Network-based IDS:
As its name suggests, network-based IDS monitor and analyze network traffics on a designated
segment. Network based IDS can be categorized as knowledge or behavior based.
For knowledge based NIDS, the systems searches for know "attack signatures” that indicates the
packets represent in intrusion. Signatures could be based on actual packet contents, and are checked by
comparing the bits against known patterns of attacks, for example, attempts to modify systems files. Other
known network attacks are protocol based where attackers seek weaknesses of a poorly administered web, file
or other servers in a network. These port attack signatures will monitor and identify attempts to connect to
network ports associated with service that are often vulnerable. Another protocol signature the systems monitors
is the abnormal or illogical TCP/IP packet headers, which is identified as denial-of-service pattern of attacks.
Behavior based NIDS identify attacks by monitoring systems or network traffic patterns and flagging
any activity that looks suspicious. The systems capture and analyze packets to define patterns of usage on the
network. Once the IDS have constructed statistics or the traffic patterns, it will audit network traffic and
analyzing them for any abnormality of the traffic pattern, which is deviated from the normal statistic.
Network based IDS provides real time monitoring and provides faster turn around time in detecting and
responding to potential attacks. Also, it is a system of probes that can be deployed at different points of the
network which are deemed critical and is prone for attack so that it can capture those attacks packets at early
stage, for example, these monitors can be located at a gateway or firewall between a corporate intranet and the
outside internet (known as router based monitoring) or inside the intranet and between the dedicated server farm
segment with other sub-segments (known as network based monitoring).

IV. Approach
Our approach implements security log analysis. It stores the alerts, and not every single log. Though, it
is recommended for log management and long term storage of ALL logs. Security Log Analysis can be called as
Log-based IDS (LIDS)
Log-based IDS (LIDS):
Log Analysis for intrusion detection is the process or techniques used to detect attacks on a specific environment
using logs as the primary source of information.

DOI: 10.9790/0661-2005011522 [Link] 18 | Page


Log Based Intrusion Detection System

LIDS is also used to detect computer misuse, policy viola-tions and other forms of inappropriate activities.
1) Benefits of LIDS:
 Cheap to implement: Does not require expensive hardware
 High visibility of encrypted protocols: SSHD and SSL traffic are good examples
 Visibility of system activity (kernel, internal daemons)
 Every application/system can be a part of it:
– They all have some kind of logs.
– Including firewalls, routers, web servers, applica-tions, etc.

V. Architecture
The HIDS can be used in two ways:
 Local (Figure 2)
– When there is just one system to monitor.
 Client/Server (Figure 3)
– When there are more than one machines connected.
– The client/server architecture is recommended.
Various daemons are used throughout the analysis of threat detection. Some of the important daemons would be:
 Analysisd - Used for log analysis.
 Remoted - Receives remote logs from agents. Maild - Used to send email alerts.
 Logcollector - Reads log files (syslog, apache logs, sshd logs, etc)
 Monitord - Monitors agent status, compresses and signs log files, etc.
 Agentd - This daemon is would run at the agent side.

A. Local Architecture
Generic log analysis flow breakdown (for local architecture)
 Log collecting is done by logcollector.
 Analysis and decoding are done by analysisd. Alerting is done by maild.
 Active responses are done by execd.
 Active responses are done by execd.

Figure 2: Log flow (Local)

B. Agent/Server Architecture
Generic log analysis flow for agent/server architecture
 Log collecting is done by logcollector.
 Analysis and decoding are done by analysisd.
 Alerting is done by maild.
 Active responses are done by execd

Figure 3: Log flow (agent/server)

DOI: 10.9790/0661-2005011522 [Link] 19 | Page


Log Based Intrusion Detection System

C. Network Communication

Figure 4: Agent/Server Network communication

Figure 4 shows the communication between agent and server. The data transmitted is compressed and
sent to the server. The transmitted data is encrypted using pre-shared keys with Blowfish encryption algorithm
[6]. The data is transmitted via UDP port 1514.

VI. Log Analysis


In this section, we’ll discuss about how the logs are analysed in the HIDS. All the logs are analysed by the
daemon named analysisd. This daemon does the log decoding and analysis.
The log flow inside analysisd comprises of 3 main parts:
1) Pre-decoding - Extracts known fields, like time, etc.
2) Decoding - Using user-defined expressions
3) Signatures - Using user-defined rules

Figure 5: Internal log flow

A. Log pre-decoding
Log pre-decoding extracts generic information from the logs, such as hostname, program name and time from
syslog header. These logs must be well formatted.
For example, log comes in as:
Apr 13 13:00:01 enigma syslogd: restart

After parsing this log, the HIDS will store it as: time/date -> Apr 13 13:00:01
hostname -> enigma program name -> syslogd log -> restart
Let us take an example of a SSHD message:
Log comes in as:
Apr 14 17:32:06 enigma sshd[1025]: Accepted password for root from [Link] port 1618 ssh2
This is how it will look like after pre-decoding: time/date -> Apr 14 17:32:06
hostname -> enigma program name -> sshd
log -> Accepted password for root from port [Link] port . . .

B. Log Decoding
Log decoding is the process to identify key information from logs. Most of the time you don’t need to
worry about it. Generally, we want to extract source ip, user name, id, etc. The list is user-defined and stored in
a file named [Link].
Let’s take a look at how the log will look like after being decoded:
Original log from SSHD:
Apr 14 17:32:06 enigma sshd[1025]: Accepted password for root from [Link] port 1618 ssh2
Log after being decoded: time/date -> Apr 14 17:32:06 hostname -> enigma program name -> sshd
log -> Accepted password for root from [Link] port . . .
srcip -> [Link] user -> root

DOI: 10.9790/0661-2005011522 [Link] 20 | Page


Log Based Intrusion Detection System

C. Log Rules
Next step after decoding is to check the rules. The rules are internally stored in a tree structure. The
rules are user-defined in an XML file which is very easy to write. It allows match, based on decoded
information. The rules are independent of the initial log format, because of the decoders.
The rules are of 2 types:
1) Atomic - Based on a single event.
2) Composite - based on patterns across multiple logs.

To write a rule, we need the following attributes:


A Rule ID (any integer)
A Level - from 0 (lowest) to 15 (highest) Level 0 is ignored, not alerted at all
Pattern - anything from ”regex” to ”srcip”, ”id”, ”user”, etc
The following rule is written for the sshd: <rule id = ”111” level = ”5”> <decoded as>sshd</decoded as>
<description>Logging every decoded sshd message</description>
</rule>
This is the second rule written which is dependent on the first rule.
The severity is high (level 7)
It will only execute if the first one matches (if sid)
Match is a simple pattern matching (looking for Failed pass)
<rule id = ”111” level = ”5”> <decoded as>sshd</decoded as>
<description>Logging every decoded sshd message</description>
</rule>
<rule id = ”122” level = ”7”> <if sid>111</if sid> <match>ˆFailed password</match>
<description>Failed password attempt</description> </rule>

D. D. Rule Structure
The rules are internally stored in a tree structure using an user-defined XML format. It is very easy to
write rules in XML format. It allows to match, based on the decoded information. The advantage of using these
rules is, that it is independent of the initial log format, because we use decoders to parse the logs and store it in a
format which is consistent. Figure 6 shows structure after first five rules. Not a flat format (like most log
analysis tools)
The rules are matched very fast. Non-sshd messages are only checked against the first rule(111), not the sub
ones.
Average of only 7/8 rules per log, instead of 400 default rules.

Figure 6: Rule structure

VII. Hardware and Software Requirements


Hardware and software requirements are very minimal.
A. Hardware requirements
Hardware requirements include: A computer with an operating system installed in it. RAM with more than 2GB
storage.

B. Software requirements
Software requirements include: GCC compiler for compiling the source code.
The HIDS server installed at the server side. The HIDS agent installed at the client/agent side. The HIDS server
should be installed on a Linux operating system. The HIDS client/agent can be installed on either Linux or
Windows operating system depending on the systems to be monitored.

DOI: 10.9790/0661-2005011522 [Link] 21 | Page


Log Based Intrusion Detection System

VIII. Conclusion
The logs generated on any system play a crucial role. The system to be developed makes use of the logs
generated by various processes and services. The logs are monitored and analyzed and any suspicious activity
that results in the alteration of the logs, is reported in real time.
The project aims at developing an effective and efficient HIDS using log analysis. Light-weight
processes known as Agents can be installed on the host machines which will run as a service in the background.
The Agents in turn communicate with the server and send the necessary data from the host.
The system focuses on logs predominantly, along with a rule-set of actions. It also consist of a web-
panel which provide an easy to use interface and an overall view of the hosts. The web panel can be used to
access the server remotely and monitor the system.

References
[1]. Piyush Nimbalkar, Varish Mulwad, Nikhil Puranik, Anupam Joshi and Tim Finin, ”Semantic Interpretation of Structured Log
Files”, 2016 IEEE 17th International Conference on Information Reuse and Integration.
[2]. K. Kent and M. Souppaya, ”Guide to computer security log management recommendations of the national institute of standards and
technology” NIST, 2006.
[3]. A. Joshi, R. Lal, T. Finin, and A. Joshi, ”Extracting cyber-security related linked data from text” in Seventh International
Conference on Semantic Computing (ICSC). IEEE, 2013,pp. 252259.
[4]. C. H. do Nascimento, R. E. Assad, B. F. Loscio, and S. R. L. Meira, ”Ontology: A security log analyses tool using web semantic
and ontology,” in 2nd OWASP Ibero-American Web Applications Security Conference, 2010, pp. 112.
[5]. Sreenivas Sremath Tirumala, Hira Sathu, Abdolhossein Sarrafzadeh, ”Free and open source Intrusion Detection Systems: A study”,
Interna-tional Conference on Machine Learning and Cybernetics, Guangzhou, 12-15 July 2015.
[6]. ”Splunk”, [Link]
[7]. ”Blowfish Cipher”, [Link] (cipher).
[8]. Ho, Swee Yenn (George), ”Intrusion Detection-Systems for today and tomorrow”, SANS Institute InfoSec Reading Room.
[9]. [Link], [Link], ”Anomaly Based Host Intrusion Detection System Using Semantic Based System Call
Patterns”, IEEE Sponsored 9th International Conference on Intelligent Systems and Control (ISCO)2015
[10]. Uzair Bashir, Manzoor Chachoo, ”Intrusion Detection and Prevention System: Challenges & Opportunities”, IEEE 2014
[11]. Atefeh Torkaman, Marjan Bahrololum, [Link], ”A Threat-aware Host Intrusion Detection System Architecture Model”,
2014 7th Inter-national Symposium on Telecommunications (IST’2014)
[12]. Melody Moh, Santhosh Pininti, Sindhusha Doddapaneni, Teng-Sheng Moh ,”Detecting Web Attacks Using Multi-Stage Log
Analysis”, 2016 IEEE 6th International Conference on Advanced Computing
[13]. Nilotpal Chakraborty, ”Intrusion Detection System and Intrusion Preven-tion System: A comparative study”, International Journal
of Computing and Business Research (IJCBR), Volume 4 Issue 2 May 2013
[14]. Sanjay Sharma and R. K. Gupta, ”Intrusion Detection System: A Review”, International Journal of Security and Its Applications,
Vol. 9, No. 5 (2015), pp. 69-76

Umesh K. Raut "Log Based Intrusion Detection System " IOSR Journal of Computer
Engineering (IOSR-JCE) 20.5 (2018): 15-22.

DOI: 10.9790/0661-2005011522 [Link] 22 | Page

View publication stats

Common questions

Powered by AI

System logs enhance the security measures provided by HIDS by serving as the primary source of data for intrusion detection. Logs offer detailed records of system activities, allowing HIDS to monitor and detect anomalies by analyzing patterns, user behaviors, and system calls. Through techniques like log-based IDS (LIDS), these logs can be thoroughly analyzed to detect policy violations, computer misuse, and other inappropriate activities . In essence, they provide the raw data that is necessary for real-time monitoring and forensic analysis to protect against potential threats .

Flexibility and scalability are critical in the design of Intrusion Detection Systems (IDS) because they ensure the IDS can adapt to rapidly changing network environments and growth in network traffic without a loss in performance. A flexible IDS can be configured to respond dynamically to evolving threats and integrate new detection rules effectively. Scalability allows the IDS to handle increasing amounts of data and nodes as organizational networks grow, maintaining consistent accuracy and performance levels . This adaptability is crucial for continually providing robust protection across diverse computing environments .

One of the main challenges faced by Host Intrusion Detection Systems (HIDS) is the high false alarm rate, which can overwhelm system administrators and undermine the effectiveness of intrusion detection. The semantic approach addresses this challenge by applying a deeper understanding of system call patterns at the kernel level, thereby providing context that helps distinguish between normal and anomalous behavior more accurately . This approach helps in reducing false positives by aligning the patterns with typical system behavior more closely, enhancing the reliability of detection .

The decision engine ELM contributes to Host Intrusion Detection Systems (HIDS) by providing high learning speed, which helps in quickly training the systems with minimal datasets. However, this comes at the cost of high processing time, meaning that while the learning phase is fast, real-time processing and response times may be higher due to the complex calculations involved .

The multi-stage log analysis architecture improves the detection of SQL injection attacks by combining both pattern matching and supervised machine learning methods. In this system, the Bayes Net model (machine learning) precedes Kibana (pattern matching), allowing for preliminary data analysis and anomaly detection through learning patterns before refining with predefined signatures in Kibana. This two-stage process enables the system to capture more nuanced signs of attack, significantly increasing the detection rate for SQL injection attacks compared to the rudimentary checks of a single-stage system .

Combining pattern matching and machine learning techniques in intrusion detection systems offers several advantages. Pattern matching allows for the real-time identification of known attack signatures or anomalies based on predefined rules, while machine learning can identify unknown threats and adapt to new patterns of behavior not explicitly programmed into the system. This combination enhances the accuracy and comprehensiveness of the detection capability, as illustrated by the multi-stage log analysis architecture that can effectively identify more sophisticated attacks like SQL injections compared to using either method alone . The dual approach provides both immediate, high-confidence alerts (pattern matching) and adaptive learning capabilities for emerging threats (machine learning).

The human labeling of network audit data is considered challenging in intrusion detection systems (IDS) due to the tedious, expensive, and time-consuming nature of accurately categorizing the vast amount of data generated by networks. Labeling requires a high level of expertise to ensure precision, as mislabeled data can lead to incorrect learning outcomes, affecting the IDS's ability to accurately detect intrusions. Moreover, the dynamic and evolving nature of threats means frequent updates to labeled datasets are necessary, increasing the effort and resources required . These challenges highlight the need for automated or semi-automated techniques to assist in reducing the workload on human operators .

The agent/server architecture facilitates effective network intrusion detection in HIDS by distributing the monitoring workload across various agents installed on the host machines, which communicate with a central server. This setup allows for scalable and efficient log collection and analysis, as agents locally process and filter data before forwarding it to the server, reducing bandwidth usage and central processing load. Additionally, server-side analysis can aggregate information from multiple agents to identify broader patterns of intrusion across the network . The use of agents also allows customization per host, increasing detection specificity and minimizing false alarms .

The application of semantic-based system call patterns contributes to reducing the false alarm rate in HIDS by adding contextual understanding to raw system caluls. By analyzing these patterns at the kernel level, HIDS can more accurately interpret whether a sequence of calls represents normal or anomalous behavior, thereby decreasing the likelihood of false positives. This detailed interpretation of system calls is crucial for distinguishing between benign anomalies and malicious activities, which traditional pattern matching might overlook without semantic context . Consequently, this approach improves the precision of intrusion detection and reduces unnecessary alerts .

Host-based Intrusion Detection Systems (IDS) have the advantage of monitoring within the host, offering detailed visibility into system activities, which includes examination of critical system file attributes and packet monitoring similar to personal firewalls . However, they come with limitations such as the potential performance overhead due to the processing of extensive activity logs and the need for significant resources for real-time analysis and reporting . Furthermore, they may not detect network-wide threats efficiently, which are outside the scope of their host-based analysis .

You might also like