Download - Academy Publisher

A. Data Preparing
To generate our test data, snort [16] was chosen as our
IDS, which is a popular open-source Network Intrusion
Detection System (NIDS). The data was accumulated
from our campus network for one month by activating
default rule sets of the Snort. Interestingly, more than 200
signatures had triggered alarms, We choose 5 minutes as
the sampling interval to generate the alarm flows.
B. Parameter Selection
Before the decomposition, we should select the values
of just two parameters, namely, the lag window length M
and the number l of leading components contained in the
subset I 1 = {i 1 , . . . , i l }. The SVD performed on matrices
obtained with a window length M is equivalent to that
performed on matrices obtained with the complementary
window K = N – M + 1. This means increasing the
window length would reproduce results already tested
with shorter window lengths, and too large window
length may introduce some disturbance. Where, l is such
that the first l components provide a good description of
the normal part of the signal and the lower M-l
components correspond to abnormal part. If l is too small
(under-fitting), we miss a part of the normal signal.
Alternatively, if l is too large (over-fitting), then we
approximate a part of abnormal signal with the normal
part. Both of these cases will make it difficult for us to
detect the deviations from the normal profile.
L3retriever Ping. wo different widow lengths M 1 = 60
and M 2 = 100 are used for comparing and anglicizing the
results.
As it can be seen from both cases, only the first few
eigenvalues are responsible for the main part of the flow
information. This means we can reconstruct the major
behavior of the alarm flow by using the first few leading
components. In fact, the first 3 eigenvalues account for
more than 90 percent of the whole energy, therefore we
prefer to choose M = 60 and l = 3 to continue the
following experiments and analysis.
C. Case Study
We use two case to make the threat evaluation, one is a
alarm flow created by the signature BARE BYTE
UNICODE ENCODING (http_inspect), the other is the
alarm flow created by the signature ICMP L3retriever
Ping. Both cases use one day’s data to perform SSAbased
decomposition and signal reconstructing. The
1
reconstructed signal X I
() t is plotted in Fig.2 (a), Fig.3
(a) along with the original signal, and the residual series
2
X I
() t can be easily obtained from the equation (4)
by I 2
I
1
X () t = X () t − X () t , which is plotted in Fig.2 (b),
Fig.3 (b).
Fig.2 Case 1 for http_inspect flow: (a) Original alarm flow series
(dotted line) and SSA-reconstructed series (continuous line)
corresponding to normal flow behavior. (b) Residual series defined as
the difference between the original and reconstructed series.
Fig.1 Percentage contribution of the eigenvalues:
(a) M 1 = 60, (b) M 2 = 100.
To properly choose the parameters, we use the radio
P
i
λ
i
= (5)
M
∑
j = 1 λ j
to estimate the energy contribution of the i-th candidate
principal component to the original flow. Fig.1 presents
M
the contribution of the eigenvalues { λ i} i = 1
corresponding
to the time series of a alarm flow with signature ICMP
As seen from the pictures, http_inspect flow play a
more stable behaviors, which we can conclude that the
threat level is not changed along with the timeline. Then
the security administrator may neglect the alarms
corresponding this signature. Different with the case 1, it
seems that there are some changes in ICMP L3retriever
Ping flow, these changes should be paid more attentions
to verify if there some new malicious behaviors occur,
and result in raising the security threat level. Although
the residual series represents the noise part of the flow, its
behaviors also reveal some useful information. For
95