Implementation of a Stateful Network Protocol Intrusion Detection Systems

S. Seng, S. Seng, J. Garcia-Alfaro, Y. Laarouci

2022

Abstract

The deployment of a Network Intrusion Detection System (NIDS) is one of the imperatives for the control of an information system. Today, almost all intrusion detection systems are based on a static vision of network exchanges, whether for detection engines based on signatures or on behavioral models. However, this approach is limited: it does not allow to directly take into account past exchanges and thus to fully model normal or abnormal behavior, such as verifying that an authentication has taken place before authorizing a privileged request or detecting a replay attack. We propose to add an additional dimension to NIDS by performing stateful monitoring of communication protocols. Unified Modeling Language (UML) statecharts have been chosen to model the protocols and to perform the stateful monitoring. An implementation of this solution is integrated within an existing NIDS and validated on two industrial protocols IEC 60870-5-104 and Modbus TCP. This implementation has been realized by dissociating the stateful monitoring and the NIDS with the help of an abstraction interface allowing an easy integration of new communication protocols.

Paper Citation

in Harvard Style

Seng S., Garcia-Alfaro J. and Laarouci Y. (2022). Implementation of a Stateful Network Protocol Intrusion Detection Systems. In Proceedings of the 19th International Conference on Security and Cryptography - Volume 1: SECRYPT, ISBN 978-989-758-590-6, pages 398-405. DOI: 10.5220/0011327400003283

in Bibtex Style

@conference{secrypt22,
author={S. Seng and J. Garcia-Alfaro and Y. Laarouci},
title={Implementation of a Stateful Network Protocol Intrusion Detection Systems},
booktitle={Proceedings of the 19th International Conference on Security and Cryptography - Volume 1: SECRYPT,},
year={2022},
pages={398-405},
publisher={SciTePress},
organization={INSTICC},
doi={10.5220/0011327400003283},
isbn={978-989-758-590-6},
}

in EndNote Style

TY - CONF

JO - Proceedings of the 19th International Conference on Security and Cryptography - Volume 1: SECRYPT,
TI - Implementation of a Stateful Network Protocol Intrusion Detection Systems
SN - 978-989-758-590-6
AU - Seng S.
AU - Garcia-Alfaro J.
AU - Laarouci Y.
PY - 2022
SP - 398
EP - 405
DO - 10.5220/0011327400003283