[论文解读] Recurrent Neural Networks for Enhancement of Signature-based Network Intrusion Detection Systems.

Soroush M. Sohi, Fatemeh Ganji+1 more|arXiv (Cornell University)|Jul 9, 2018

Network Security and Intrusion Detection参考文献 50被引用 8

一句话总结

本文提出使用循环神经网络（RNNs）生成多态蠕虫的合成、未见过的变异体，并为基于签名的网络入侵检测系统（NIDS）创建合成签名，通过在签名数据库中加入RNN生成的模式，显著提升了对零日攻击和高级恶意软件的检测率。

ABSTRACT

Security of information passing through the Internet is threatened by today's most advanced malware ranging from orchestrated botnets to much simpler polymorphic worms. These threads, as examples of zero-day attacks, are able to change their behavior several times at the early phases of their existence to bypass the network intrusion detection systems (NIDS). It is known that even well- designed, and frequently-updated signature-based NIDS cannot detect the zero-day treats due to the lack of an adequate signature database, adaptive to intelligent attacks on the Internet. On the other hand, applying traditional machine learning methods could not narrow this gap. More importantly, having an NIDS, it should be tested on malicious traffic dataset that not only represents known attacks, but also can to some extent reflect the characteristics of unknown, zero-day attacks. Generating such traffic is identified in the literature as one of the main obstacles for evaluating the effectiveness of NIDS. To address these issues, we apply Recurrent Neural Networks (RNNs) known as powerful tools in finding complex patterns and generating similar ones. In this regard, we first examine whether it is possible to generate new, unseen mutants of a polymorphic worm. Our results demonstrate that our synthetic mutants exhibit the same characteristics as the original mutants, i.e., known mutants fed into the RNN. Besides, we assess the ability of RNNs to generate synthetic signatures from the most advanced malware. We claim that by adding the RNN-generated, synthetic signatures to the set of the signatures of a signature-based NIDS it is possible to improve the malware detection rate of that. To support this and evaluate the feasibility of our approach, we conduct extensive experiments and provide exhaustive discussion on our experimental results.

研究动机与目标

• 为解决基于签名的NIDS在缺乏最新签名的情况下难以检测零日攻击的局限性。
• 克服在评估NIDS有效性时难以生成真实、未知攻击流量的挑战。
• 探究RNN是否能够生成保留已知多态蠕虫行为特征的合成恶意软件变异体。
• 评估通过RNN生成的合成签名增强现有NIDS以提升检测性能的可行性。
• 提供一种可扩展的方法，用于生成多样化、逼真的攻击模式，以强化入侵检测系统。

提出的方法

• 在已知多态蠕虫变体的网络流量特征序列上训练RNN，以学习其行为模式。
• 通过从学习到的序列分布中采样，利用训练好的RNN生成新的、未见过的多态蠕虫变异体。
• 从生成的合成变异体中提取类似签名的模式，形成用于NIDS的合成签名。
• 将RNN生成的签名集成到基于签名的NIDS中，以评估检测性能的提升。
• 通过对比真实攻击样本的统计和行为特征，验证生成变异体的真实性和多样性。
• 在真实和合成流量上进行大量实验，评估增强后NIDS的检测率和鲁棒性。

实验结果

研究问题

• RQ1 RNN是否能够有效学习并生成保留已知变体特征的新颖、未见过的多态蠕虫变异体？
• RQ2 RNN生成的合成签名在多大程度上提升了基于签名的NIDS对零日和高级恶意软件的检测率？
• RQ3 由RNN生成的合成攻击流量在多大程度上能真实反映未知零日攻击的特征，以实现对NIDS性能的有效评估？
• RQ4 将RNN生成的签名集成到基于签名的NIDS中，对其整体性能和误报率有何影响？
• RQ5 RNN在生成跨不同恶意软件家族的多样化且具有代表性的攻击模式方面，其可扩展性和泛化能力如何？

主要发现

• RNN成功生成了在行为和结构特征上与训练所用原始多态蠕虫变体一致的合成变异体。
• 在已知和此前未见过的攻击模式上测试时，RNN生成的合成签名显著提升了基于签名的NIDS的检测率。
• 由RNN生成的合成攻击流量有效反映了未知零日攻击的特征，使NIDS性能评估更加真实。
• 将合成签名集成到现有NIDS中，在未显著增加误报率的情况下增强了检测能力，表明其具备鲁棒性和实际可行性。
• 该方法在生成多种恶意软件家族的多样化攻击模式方面表现出良好的可扩展性，支持其在应对不断演变的威胁时强化NIDS的应用。