PRIvacy LEakage Methodology (PRILE) for IDS Rules - Inria - Institut national de recherche en sciences et technologies du numérique Access content directly
Conference Papers Year : 2010

PRIvacy LEakage Methodology (PRILE) for IDS Rules

Abstract

This paper introduces a methodology for evaluating PRIvacy LEakage in signature-based Network Intrusion Detection System (IDS) rules. IDS rules that expose more data than a given percentage of all data sessions are defined as privacy leaking. Furthermore, it analyses the IDS rule attack specific pattern size required in order to keep the privacy leakage below a given threshold, presuming that occurrence frequencies of the attack pattern in normal text are known. We have applied the methodology on the network intrusion detection system Snort's rule set. The evaluation confirms that Snort in its default configuration aims at not being excessively privacy invasive. However we have identified some types of rules rules with poor or missing ability to distinguish attack traffic from normal traffic.
Fichier principal
Vignette du fichier
nils.pdf (560.22 Ko) Télécharger le fichier
Origin : Files produced by the author(s)
Loading...

Dates and versions

hal-01061167 , version 1 (05-09-2014)

Licence

Attribution

Identifiers

Cite

Nills Ulltveit-Moe, Vladimir Oleshchuk. PRIvacy LEakage Methodology (PRILE) for IDS Rules. 5th IFIP WG 9.2, 9.6/11.4, 11.6, 11.7/PrimeLife International Summer School(PRIMELIFE), Sep 2009, Nice, France. pp.213-225, ⟨10.1007/978-3-642-14282-6_17⟩. ⟨hal-01061167⟩
340 View
408 Download

Altmetric

Share

Gmail Facebook X LinkedIn More