Abstract
When optimizing our NIDS APAP [1] we started focusing our efforts on ensuring that it would work on real-time network traffic. This effort, was penalized by the excessive cost of storage of various data structures needed to meet its goals satisfactorily.
APAP is based on Anagram [2] and initially worked with small size N-gram. This allowed us to detect more attacks at the expense of a higher rate of false positives. But when we wanted to test the results obtained with larger N-gram sizes, we found that the cost of storage of the Bloom filter structures that we generated to analyze the payload of the traffic was too large.
This is a preview of subscription content, log in via an institution to check access.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
References
García-Villalba, L.J., Mejía-Castro, J.D., Sandoval-Orozco, A.L., Martínez-Puentes, J.: Malware Detection System by Payload Analysis of Network Traffic. In: Proceedings of the 15th International Symposium on Research in Attacks, Intrusions and Defenses (September 2012)
Wang, K., Parekh, J.J., Stolfo, S.J.: Anagram: A Content Anomaly Detector Resistant to Mimicry Attack. In: Zamboni, D., Kruegel, C. (eds.) RAID 2006. LNCS, vol. 4219, pp. 226–248. Springer, Heidelberg (2006)
Broder, A., Mitzenmacher, M.: Network applications of bloom filters: A survey. In: Internet Mathematics, pp. 636–646 (2002)
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2012 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Vega, H.V., Vidal, J.M., Castro, J.D.M., Villalba, L.J.G. (2012). Improvement of an Anagram Based NIDS by Reducing the Storage Space of Bloom Filters (Poster Abstract). In: Balzarotti, D., Stolfo, S.J., Cova, M. (eds) Research in Attacks, Intrusions, and Defenses. RAID 2012. Lecture Notes in Computer Science, vol 7462. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-642-33338-5_28
Download citation
DOI: https://doi.org/10.1007/978-3-642-33338-5_28
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-642-33337-8
Online ISBN: 978-3-642-33338-5
eBook Packages: Computer ScienceComputer Science (R0)