Detecting Exploit Patterns from Network Flow Streams

An Intrusion Detection System (IDS) is a piece of software and/or hardware designed to detect unwanted attempts at accessing, manipulating, and disabling of computer systems, through a network such as the Internet. Network-based Intrusion Detection Systems (NIDS) try to detect malicious activities by monitoring network traffic. Research on network traffic measurement has identified various patterns that the typical exploits on today’s Internet exhibit. The goal of our research is to devise single-pass (online) data stream algorithms for detecting these patterns from network traffic flow data, using a workspace that is much smaller than the size of the traffic flow. We aim to design algorithms with a provable guarantee on the space and time requirements and the degree of approximation in the estimates returned.