[Paper Review] PCkAD: an unsupervised intrusion detection technique exploiting within payload n-gram location distribution.

Fabrizio Angiulli, Luciano Argento+1 more|arXiv (Cornell University)|Dec 11, 2014

Network Security and Intrusion Detection9 references3 citations

TL;DR

This paper proposes PCkAD, an unsupervised anomaly-based intrusion detection technique that analyzes within-payload n-gram location distributions to detect content-based attacks over application-layer protocols like HTTP and FTP. By modeling byte sequence patterns in fixed-length payload chunks per protocol and packet length, PCkAD achieves high detection accuracy with a very low false positive rate.

ABSTRACT

Signature-based and protocol-based intrusion detection systems (IDS) are employed as means to reveal content-based network attacks. Such systems have proven to be effective in identifying known intrusion attempts and exploits but they fail to recognize new types of attacks or carefully crafted variants of well known ones. This paper presents the design and the development of an anomaly-based IDS technique which is able to detect content-based attacks carried out over application level protocols, like HTTP and FTP. In order to identify anomalous packets, the payload is split up in chunks of equal length and the n-gram technique is used to learn which byte sequences usually appear in each chunk. The devised technique builds a different model for each pair of protocol of interest and packet length, in terms of number of chunks, and use them to classify the incoming traffic. Models are build by means of an unsupervised approach. Experimental results witness that the technique achieves an excellent accuracy with a very low false positive rate.

Motivation & Objective

• To address the limitation of signature- and protocol-based IDS in detecting novel or obfuscated attacks.
• To develop an anomaly-based detection technique effective for application-layer protocols such as HTTP and FTP.
• To model payload content patterns using unsupervised learning without requiring labeled attack data.
• To reduce false positives while maintaining high detection accuracy for unknown attack variants.

Proposed method

• The payload of network packets is divided into equal-length chunks to enable localized pattern analysis.
• The n-gram technique is applied to each chunk to extract and learn frequent byte sequence patterns.
• Separate models are constructed for each combination of protocol and packet length (in terms of number of chunks).
• An unsupervised learning approach is used to build models based on normal traffic patterns without labeled attack examples.
• Classification of incoming traffic is performed by comparing its n-gram distribution in chunks against the learned models.
• Anomalies are detected when the payload's n-gram distribution significantly deviates from the expected distribution in the corresponding model.

Experimental results

Research questions

• RQ1 Can an unsupervised approach effectively detect unknown content-based attacks in application-layer protocols?
• RQ2 How well can n-gram distribution modeling in fixed payload chunks identify novel or obfuscated attack variants?
• RQ3 What is the trade-off between detection accuracy and false positive rate in such an anomaly-based system?
• RQ4 Can protocol-specific and length-specific models improve detection precision for diverse traffic patterns?

Key findings

• The proposed PCkAD technique achieves high detection accuracy for content-based attacks in application-layer protocols.
• The system demonstrates a very low false positive rate, indicating strong precision in distinguishing normal from anomalous traffic.
• The use of protocol- and length-specific models enhances detection performance by capturing protocol-specific payload structures.
• Unsupervised model training enables detection without requiring labeled attack samples, improving adaptability to new threats.