TECHNICAL SEMINAR ON“APPLICATION LAYER ANOMALY DETECTION

BASED ON HSMM”

UNDER THE GUIDANCE

OF Mr. Annappa Swamy D R

PRESENTED BY

Akash D 4MT12CS008

OBJECTIVE

Detect unknown attacks occur at application layer.

Describe the user’s application layer behaviours.

Detect the potential attacker based on their average

log likelihoods.

ABSTRACT Today more network-based attacks occur at

application layer.

Traditional security techniques can only detect

some known attacks.

A new application layer anomaly detection method

which based on HSMM is proposed to detect

unknown attacks.

HIDDEN SEMI-MARKOV MODEL The HSMM is a finite set of states, where each of states and

the transitions among them is associated with a probability

distribution.

The probability of there being a change in the hidden state

depends on the amount of time that has elapsed since entry

into the current state.

EXAMPLE:-

HSMM is a finite state machine, specified by

{A,B,P,π}, where

A is the state transition matrix.

B is the observation probability matrix.

P is the state duration matrix.

π is the initial state matrix.

A={amn}, 1≤m, n≤M, M is the total number of hidden

states.

B={bm(vk)}, 1≤k≤K, K is the size of observable output

set.

P={pm(d)}, 1≤d≤D, D is the maximum interval

between any two consecutive state transitions.

π={πm}, 1≤m≤M.

λ=({amn}, {bm(vk)}, {pm(d)}, {πm}) where λ stand for

the complete set of model parameters.

HSMM can be used for classification and pattern

matching by solving learning evaluation decoding

These problems can be solved by forward-backward algorithm

Forward-backward algorithm steps

1) Computing forward probabilities

2) Computing backward probabilities

3) Computing smoothed values

ARCHITECTURE DESIGN

APPLICATION LAYER ANOMALY DETECTION BASED ON HSMM

The similarities in characteristics of normal

user’s behaviour is taken as profile of the normal

users.

User’s behaviour can be considered as a series

of application layer protocol keywords.

o Application layer protocol keywords sequences

describe the user’s application layer behaviour.

fig.1 HTTP keyword sequence

Fig. http keyword sequences

The change in user’s behavior will make the

distribution of keywords to be different.

The different behaviours can be considered as the

different states.

The state transitions process can be considered as a

Markov process.

States can’t be observed directly and is hidden

Markov process.

WORKING MODULE

1. DETERMINATION THE MODEL

Assume user’s behaviour has M discrete states,

namely S1, S2,...,SM..

Let A stand for the state transition probability

matrix, A={amn},1≤m,n≤M.

Assuming the protocol has K keywords, which can

be expressed as: word1, word2, ..., wordK

Let P denote the state duration probability

matrix, P={pm(d)}, 1≤d≤D

Let π stand for the initial probability matrix,

π={πm}, 1≤m≤M.`

Let ot stand for the observable output at t from

the network gateway i.e ot=(wt,rt).

Let O=o1,o2,...,oT =o1T, where T is the number of

samples in the observed sequence

Let B stand for the observation probability

matrix,

2. TRAINING PHASE

Train the model to determine the parameters of

the HSMM.

retaining the best parameters of legitimate

HSMM leads to more accurate results.

3. DETECTION PHASE

Check whether the observation sequences from a user is

similar to most of the normal users.

To compare different sequences' likelihood average log

likelihood(ALL) is used.

If a user's observation sequence's ALL locates in the

confident interval, the user will be consider as normal user.

Otherwise the user will be considered as potential attacker

that should be controlled.

APPLICATION DOMAIN Application layer distributed denial of service

attacks for popular websites.

Coping with the attacks launched by dynamic

webpage (e.g., script) in web user’s behaviour.

CONCLUSION

Hidden semi markov model is used to describe the

user’s application layer behavior.

Observation sequence’s average log likelihood

against the normal model is calculated.

Detect the potential attacker based on their average

log like hood.

Thank you