@inproceedings{db214a765dd64e5ab3a0ef8aebc1874a,
title = "N-gram Against the Machine: On the Feasibility of the N-gram Network Analysis for Binary Protocols",
abstract = "In recent years we have witnessed several complex and high-impact attacks specifically targeting {\textquotedblleft}binary‿ protocols (RPC, Samba and, more recently, RDP). These attacks could not be detected by current {\textendash} signature-based {\textendash} detection solutions, while {\textendash} at least in theory {\textendash} they could be detected by state-of-the-art anomaly-based systems. This raises once again the still unanswered question of how effective anomaly-based systems are in practice. To contribute to answering this question, in this paper we investigate the effectiveness of a widely studied category of network intrusion detection systems: anomaly-based algorithms using n-gram analysis for payload inspection. Specifically, we present a thorough analysis and evaluation of several detection algorithms using variants of n-gram analysis on real-life environments. Our tests show that the analyzed systems, in presence of data with high variability, cannot deliver high detection and low false positive rates at the same time.",
keywords = "METIS-296090, IR-81815, Detection, N-gram, EWI-22269, feasibility, SCS-Cybersecurity, DIES-Network Security, binary protocol",
author = "D. Hadziosmanovic and Lorenzo Simionato and D. Bolzoni and Emmanuele Zambon and Sandro Etalle",
note = "10.1007/978-3-642-33338-5\_18 ; 15th International Symposium on Research in Attacks, Intrusions and Defenses, RAID 2012 ; Conference date: 12-09-2012 Through 14-09-2012",
year = "2012",
month = sep,
doi = "10.1007/978-3-642-33338-5\_18",
language = "Undefined",
isbn = "978-3-642-33337-8",
series = "Lecture Notes in Computer Science",
publisher = "Springer",
pages = "354--373",
booktitle = "Proceedings of the 15th International Symposium on Research in Attacks, Intrusions and Defenses (RAID 2012)",
address = "Germany",
}