UTILIZING INTRUSION PREVENTION SYSTEM TO FETCH OBSCURE SESSIONS OVER NETWORK TRAFFIC

Abstract

To a great extent traffic travels on the network every minute a day. As the traffic increases much of signatures get defined. Some traffic falls into category of ‘obvious’ and another into ‘obscure’. Obvious is what network expects and healthily transmits but obscure will be causing harm to network. When it comes to distinguishing between obvious and obscure traffic, a lot of packets has to pass through an Intrusion Prevention System and on the basis of that whatever packets moves towards right destination carrying destined information and the packets causing harm to the network can be distinguished. So wise False Positives and False Negatives happens to every IPSs. None of the system could judge better all the time. The key purpose here is to design Obscure Session Fetching (OSF) System to fetch obscure sessions as entire and perfect as possible which gives IPS developers resources for further analysis. First, the OSF captures real traffic and replays captured traffic traces to multiple IPSes then starts to fetch obscure traffic from replayed traffic traces and then verifies and validates it. IPS developers can further analyse the fetched traffic traces and confirm that some are FNs or FPs. To entirely and perfectly fetch an obscure session, the OSF uses an association mechanism based on anchor packets, five tuples and time, and similarity for the first packet, first connection, and whole session, respectively. It calculates the degree of similarity among packets to fetch an obscure session containing multiple connections. I defined variation and entireness/perfectness as the indexes to evaluate the OSF. The experiments demonstrate that 97% of fetched sessions have low variation, and the average entireness/perfectness is around 85%. Also presented four case studies, First is a P-FN andthe other is a P-FP, and second is a N-FN and the other is a N-FP found by the OSF and confirmed by the IPS developers.