Research:

Network traffic simulation for intrusion detection.

Network security is an important issue faced by the IT industry nowadays.  Among all the security problems, study of network intrusion and detection are especially difficult and urgent due to the inexpectancy and nonrepeatability of the real attack scenario.  Hackers apply an array of techniques to cause disruption of normal system operations, but on the defense, the firewalls and practical intrusion detection systems (IDS) nowadays are only effective in defending known intrusions using their signatures, and far less than mature when faced with novel attacks. Thus, it is very promising if we are able to use simulator to replay the attack scenario and study their intrinsic characters, and then find the way to defeat it. 

Our work deals with simulation of intrusion traffic by explicitly generating data packets based on real-life TCPDUMP data that contain intrusion packets. The explicitly generated traffic in OPNET simulation allows research on data filtering and intrusion detection strategies.  Some of our experimental studies of simulation using OPNET is described in the following figures. Both the efficiency and network performance of simulated networks is observed and reported.  

Figure 1: The network model simulating Dosnuke intrusion (left); The attribute panel of the packet generator, with customized packet format and scripted packet inter-arrival times calculated from pre-processing the source data (right).

Figure 2. The inbound traffic of the firewall (left); Data traffic to Port 25 of the victim PC (right).

Figure 3 The simulation model for processTable attack and the underlying process for building the model.

Frequency-based intrusion detection strategy. 

Frequency-based intrusion detection strategy searches for frequency patterns within the time series created by network traffic signals. This new strategy is aimed for, but not limited to, DOS and Probe attack. The detection method is based on the observation that such kind of attacks are most likely manipulated by scripted codes, which may result periodic patterns in either packet streams or the connection arrivals. Thus, by applying Fourier analysis to the time series created by network traffic signals, we could identify whether the periodic patterns exist in the traffic.  The experimental results on the DARPA datasets indicated that the proposed intrusion detection strategy is effective in detecting certain anomalous traffic data from large-scale time series data that exhibit patterns over time. The advantage of the strategy does not depend on prior knowledge of attack signatures, thus it has the potential to supplement any signature-based Intrusion detection systems (IDS) and firewalls.

Connection 0	Connection 1	Connection 2
Connection 3	Connection 4	Connection 5

Figure 1: The frequency pattern on inter-arrival time of several  connections including a ProccessTable attack and a Probe attack. The data comes from 1999 DARPA dataset.