This document discusses network security and intrusion detection systems. It provides an overview of host-based and network-based intrusion detection, as well as misuse detection techniques like SNORT and anomaly detection using artificial neural networks or artificial immune systems. It also discusses issues like authentication, confidentiality, integrity and availability in network security and goals of intrusion detection systems.

1. Network Security Pascal Bouvry Faculty of Sciences, Technology and Communication University of Luxembourg

6. IDS

7. CERT IODEF Incident Object Description and Exchange Format

12. TCP Handshake C S SYN C SYN S , ACK C ACK S Listening Store data Wait Connected

16. Detailed network config

21. Signature-based - SNORT

29. Anomaly Detection

32. Terms (1) Construction and shape space

33. Terms (2) Affinity and match

35. AIS: Self – Nonself (2)

36. AIS (Seredynski/Bouvry)

39. Results on MIT data set Sliding window size = 1 Sliding window size = 3

46. Self organizing networks

47. T ypes of ad hoc networks PKI

49. Network properties: m ulti hop communication Let’s suppose that n ode A wants to communicate with node M . It should do the following: 1. find a route (using a routing protocol) 2. send packets using the path found by the routing protocol. In the source routing protocols sender specifies the full path to the destination. In the presented example, path from node M to node A includes nodes L-H-E

50. Trust Management

53. Security related issues

54. Case study: routing

59. Definitions: activity Activity describes how often node is available for routing purposes. Nodes joining the network or nodes spending a lot of time in sleep mode will have lower activity levels. Power consumption in different modes

60. Proposed Approach

61. How to cope with selfishness? This approach enforces cooperation because selfish nodes will not be able to use the network for their own purposes (because of their bad reputation or low activity ) The scheme: 1. Each node is collecting reputation data concerning the behavior of network participants 2. Using reputation data , trust and activity of other known node s can be calculated 3. When it receives a packet that should be forwarded, first it checks the trust and activity level s to the source of the packet (original sender) 4. If such a packet comes from a non-trusted or not active node than it is very likely that it is going to be d iscarded . Solution: enforce cooperation based on trust and activity

62. Overview Genetic Algorithm : a search tool

64. Reputation and Trust evaluation

68. Strategy: details

70. Experiments

72. The evolution of cooperation

75. Conclusion

77. Thank you! Questions?