ICACT20240269 Slide.23
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Well, this is the end of my presentation. If you have any questions, please feel free to tell me or send me an e-mail. Thank you.
|
|
ICACT20240269 Slide.22
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In conclusion, we propose a real-time system to prevent malicious payloads in network traffic. To enhance the snort firewall's defensive rate of packets, the system adopts hybrid algorithms like K-means and LSHash. Our system can automatically generate snort firewall rules and aim to resolve manually defined rules config errors. Also, the defensive rate of our system reaches 93%. In summary, this study contributes to preventing malicious packets. Secondary clustering and payload analysis are feasible research directions for detecting malicious packets.
|
|
ICACT20240269 Slide.21
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The final part is conclusion.
|
|
ICACT20240269 Slide.20
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The experimental results are summarized in the table. Initially, there were 27 clusters, but after implementing the hybrid clustering method, the number of clusters increased to 42. Following the experiments mentioned above, it can be found that the defensive rate of malicious packets increased from 91% to 93%, which shows that adding LSH as one of the clustering techniques improves the detection effect of snort abnormal packets.
|
|
ICACT20240269 Slide.19
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The next part is performance analysis.
|
|
ICACT20240269 Slide.18
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
It is necessary to establish a corresponding testing environment and test the results with appropriate tools to validate whether the snort rule generator produces snort rules that can be detected effectively.
In this study, the testing environment is Kali Linux. The testing process is illustrated in the figure. In this procedure, the sender transmits packets to the receiver, where the receiver uses the snort-generated firewall to inspect these packets. It takes appropriate actions based on preconfigured rules for the payload. The sender utilizes a Python script written with Scapy to generate attack packets and send them to the receiver, simulating the behavior of an attacker. If Snort detects the malicious packet, it will alert the receiver and prevent the malicious packet from going through the firewall.
|
|
ICACT20240269 Slide.17
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
I divided datasets into two parts: implementing systems and testing. The datasets are both collected from Cowrie Honeypot in 2022. For implementing systems, there are 19080 payloads for clustering and generating the snort rule; on the other hand, the testing part has 193 payloads to test.
|
|
ICACT20240269 Slide.16
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Now, I will discuss my experiment with the dataset and testing situation.
|
|
ICACT20240269 Slide.15
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
A PCRE Snort rule will be like the below graph. First, we have action, which tells Snort what to do when the rule matches, and then the rule protocol describes what the rule focuses on. Source IP, Source port, Destination IP, and Destination port are used to assign the IP and port we can send and get the packet. Next, shown in the table, you can see the details of the rule option. The most important one is PCRE; we generate the regular expression and fill it into the space to represent the content of each cluster.
|
|
ICACT20240269 Slide.14
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The entire generated process will be shown in the figure below. We have packet_payload in the same cluster. Then, we will use a Regex Generator with a Genetic Algorithm to create a regular expression for this cluster. Finally, we use the regular expression to generate a PCRE Snort rule.
|
|
ICACT20240269 Slide.13
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Now, I am going to introduce how we defend against Malicious Payload. This study uses Snort as the primary malicious packet detection and analysis tool. Snort is a popular, lightweight Network Intrusion Detection System. It can use a rule-based language and be deployed on a physical device to defend against malicious traffic.
|
|
ICACT20240269 Slide.12
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In this phase, further processing is applied to the data that was previously clustered using K-means and labeled with MITRE ATT&CK. We will use Locality-sensitive Hashing to deal with the data. LSH is utilized for clustering, grouping similar payloads into the same clusters to generate more clusters. The
typical processing involves the following steps: 1. Shingling: converting a string of text into a set of ‘shingles.’ 2. To obtain a denser vector of named signature, n min-Hash functions are used to obtain n min-Hash values. After applying Min-Hashing, we get signatures that retain similar information. 3. The final step in identifying similar sentences is the LSH function itself. We choose a hash function to calculate the similarity and put the similar payload into the same buckets. After that, we will get more clusters with a hybrid clustering algorithm compared to the former.
|
|
ICACT20240269 Slide.11
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Following K-means clustering, data is labeled based on the payload content using MITRE ATT&CK's Tactic, Technique, and Subtechnique. As you can see on the left-hand side, the first payload content means Get Certain Device Information, so its Tactic is Discovery, and its Technique is Peripheral Device Discovery. The second payload is brute force attack visibility, its Tactic is Credential Access, and its Technique is Brute Force. The last one is Download Malicious File, which belongs to the Execution and it’s Technique is Command and Scripting Interpreter.
|
|
ICACT20240269 Slide.10
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
To label attack behavior, we use MITER ATT&CK TTP. MITRE ATT&CK is a concept of ATT&CK, including Adversarial Tactics, Techniques, & Common Knowledge, to help organizations understand and analyze cyber attacks using a common language and framework. It will be updated regularly with new types of attacks, which allows it to represent classified attacks more systematically.
|
|
ICACT20240269 Slide.09
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In the second step, we use K-means to classify the data. K-means is an unsupervised clustering algorithm designed to partition unlabelled data into a certain number of distinct groupings. Following is the process of the K-means algorithm: First, the algorithm randomly selects a centroid for each cluster. If we choose a K of 3, there will be three centroids with 3 clusters. Next, The shortest Euclidean distance algorithm is employed to calculate the distances between each data point and the cluster centroids. Each data point is then assigned to the cluster associated with the nearest centroid. Third, the centroids of each cluster are recalculated by taking the average of all data points within that cluster. At last, Steps 2 and 3 are repeated iteratively until the cluster centroids no longer change or change very minimally.
|
|
ICACT20240269 Slide.08
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
This system uses the Cowrie Honeypot as a trap to lure potential attackers into the system. Cowrie is a highly interactive honeypot designed to capture and log sessions initiated by attackers using SSH and Telnet protocols. To make the data easier to understand, we reorganized the data into a data frame after obtaining the Crowie log. You'll find the data we want to use for classification on the right-hand side.
|
|
ICACT20240269 Slide.07
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The proposed method will be separated into five parts: Pre-processing the data collected from the honeypot, Grouping similar payloads into each cluster, classifying attack behavior and labeling with MITER ATT&CK, Calculating payload similarity and clustering using Locality-Sensitive Hashing, generating PCRE regex Snort rule for Intrusion Prevention System filtering.
|
|
ICACT20240269 Slide.06
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Next, I am going to talk about the Proposed Method part.
|
|
ICACT20240269 Slide.05
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In addition, attackers constantly find new ways to attack victims' computers and steal sensitive information. Our study has aimed to address this problem by designing a system that uses a hybrid clustering algorithm to generate a firewall to prevent important data loss. The implementation details will be covered in the next section.
|
|
ICACT20240269 Slide.04
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
As technology continues to advance, the popularity of the Internet continues to expand, profoundly affecting people around the globe. The widespread adoption of the global network has been accompanied by a startling surge in cyberattacks in recent years. As shown in the figure, the losses due to data breaches caused by cyber attacks have been steadily increasing year by year.
|
|
ICACT20240269 Slide.03
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In the first part of our presentation, I'd like to start with an introduction. First introduce the background of the study and the motivation behind our research.
|
|
ICACT20240269 Slide.02
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
As you can see in the outline on the screen, this presentation is divided into five main parts: Introduction, Proposed Method, Experiment, Performance Analysis, and Conclusion.
|
|
ICACT20240269 Slide.01
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Hello, everyone. My name is Pin Shan, Lin. I’m from National Taiwan University of Science and Technology. Today I’m happy to present our work, Hybrid Clustering Mechanisms for High-Efficiency Intrusion Prevention.
|
