Skip to main content
SpringerLink
Log in

Intrusion Detection as Passive Testing: Linguistic Support with TTCN-3 (Extended Abstract)

  • Conference paper
Detection of Intrusions and Malware, and Vulnerability Assessment (DIMVA 2007)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 4579))

Abstract

We explore the idea of using the internationally standardized test language TTCN-3 (Testing and Test Control Notation) as a platform for Intrusion Detection (ID) systems. Intrusion detection is treated as an application of verification by passive testing. It is argued that TTCN contains many features embodied in various “detection languages”, and is relevant for ID. As a case study, we discuss a TTCN-based IDS for detecting the Smurf attack.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. ITU-T Z.500, Framework on Formal Methods in Conformance Testing. Geneva (1997)

    Google Scholar 

  2. Brzezinski, K.M.: Towards Practical Passive Testing. In: Proc. PDCN 2005, Innsbruck (2005)

    Google Scholar 

  3. Labib, K., Vemuri, V.R.: Detecting And Visualizing Denial-of-Service and Network Probe Attacks Using Principal Component Analysis. In: Proc. SAR 2004, La Londe (2004)

    Google Scholar 

  4. Debar, H., Dacier, M., Wespi, A.: Towards a Taxonomy of Intrusion Detection Systems. Computer Networks. Int. J. Comp. and Telecomm. Networking 31(9) (1999)

    Google Scholar 

  5. Ko, C., Ruschitzka, M., Levitt, K.: Execution Monitoring of Security-critical Programs in Distributed Systems: A Specification-based Approach. In: Proc. IEEE SSP (1997)

    Google Scholar 

  6. Uppuluri, P., Sekar, R.: Experiences with Specification-based Intrusion Detection. In: Lee, W., Mé, L., Wespi, A. (eds.) RAID 2001. LNCS, vol. 2212, Springer, Heidelberg (2001)

    Chapter  Google Scholar 

  7. Ledru, Y., et al.: Test Purposes: Adapting the Notion of Specification to Testing. In: Proc. ASE 2001, San Diego (2001)

    Google Scholar 

  8. Eckmann, S.T., Vigna, G., Kemmerer, R.A.: STATL: An Attack Language for State-based Intrusion Detection. In: JCS 2002 (2002)

    Google Scholar 

  9. Grabowski, J., Wiles, A., Willcock, C., Hogrefe, D.: On The Design of the New Testing Language TTCN-3. In: Proc. Testcom 2000 (2000)

    Google Scholar 

  10. ETSI ES 201 873. Methods of Testing and Specification; The Testing and Test Control Notation version 3 (release: 3.2.1, 2007-02)

    Google Scholar 

  11. ISO/IEC 9646. Information Technology; Open Systems Interconnection; Conformance Testing Methodology and Framework; Parts 1-7

    Google Scholar 

  12. Orset, J.-M., Alcalde, B., Cavalli, A.: An EFSM-Based Intrusion Detection System for Ad Hoc Networks. In: Peled, D.A., Tsay, Y.-K. (eds.) ATVA 2005. LNCS, vol. 3707, Springer, Heidelberg (2005)

    Chapter  Google Scholar 

  13. Sekar, R., Uppuluri, P.: Synthesizing Fast Intrusion Prevention / Detection Systems from High-Level Specifications. In: Proc. USENIX 1999 (1999)

    Google Scholar 

  14. Sekar, R., Cai, Y., Segal, M.: A Specification-Based Approach for Building Survivable Systems. In: Proc. NISSC 1998 (1998)

    Google Scholar 

  15. Hofmann, R., et al.: Distributed Performance Monitoring: Methods, Tools, and Applications. IEEE Trans. on Parallel and Distributed Systems 5(6) (1994)

    Google Scholar 

  16. Paxson, V.: Bro: a System for Detecting Network Intruders in Real-Time. Computer Networks 31, 23–24 (1999)

    Article  Google Scholar 

  17. Bhargavan, K., Gunter, C.: Requirements for a Practical Network Event Recognition Language. Electronic Notes in Theoretical Computer Science 70(4) (2002)

    Google Scholar 

  18. Schieferdecker, I., Stepien, B., Rennoch, A.: PerfTTCN, a TTCN Language Extension for Performance Testing. In: Proc. 10th IWTCS, Cheju Island (1997)

    Google Scholar 

  19. Sabiguero, A., Baire, A., Floch, A., Viho, C.: Using TTCN-3 in the Internet Community: an Experiment with the RIPng Protocol. In: Proc. 2nd TTCN-3 User Conference (2005)

    Google Scholar 

  20. Deussen, P.H., Din, G., Schieferdecker, I.: A TTCN-3 Based Online Test and Validation Platform for Internet Services. In: Proc. ISADS 2003 (2003)

    Google Scholar 

  21. Dai, Z.: TimedTTCN-3, a Real-time Extension for TTCN-3. In: Proc. TestCom 2002, Berlin (2002)

    Google Scholar 

  22. Walter, T., Grabowski, J.: Test Case Specification with Real-Time TTCN. In: Proc. 7 GI/ITG Technical Meeting on ’Formal Description Techniques for Distributed Systems’, Berlin (1997)

    Google Scholar 

  23. Kaminski, T.: New Applications of the TTCN-3 Language. MSc. Thesis, Institute of Telecommunications, Warsaw University of Technology (in Polish) (2006)

    Google Scholar 

  24. Bononi, F., Mitzenmacher, M., Panigrahy, R., Singh, S., Varghese, G.: Beyond Bloom Filters: From Approximate Membership Checks to Approximate State Machines. In: Proc. SIGCOMM 2006 (2006)

    Google Scholar 

  25. Din, G., Rentea, G.: Using TTCN-3 to Design Performance Tests. In: Proc. TTCN-3 UC, Berlin (2006)

    Google Scholar 

  26. Netravali, A.N., Sabnani, K.K., Viswanathan, R.: Correct Passive Testing Algorithms and Complete Fault Coverage. In: König, H., Heiner, M., Wolisz, A. (eds.) FORTE 2003. LNCS, vol. 2767, Springer, Heidelberg (2003)

    Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Institute of Telecommunications, Warsaw University of Technology, Nowowiejska 15/19, 00-665 Warszawa, Poland

    Krzysztof M. Brzezinski

Authors
  1. Krzysztof M. Brzezinski
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Bernhard M. Hämmerli Robin Sommer

Rights and permissions

Reprints and permissions

Copyright information

© 2007 Springer-Verlag Berlin Heidelberg

About this paper

Cite this paper

Brzezinski, K.M. (2007). Intrusion Detection as Passive Testing: Linguistic Support with TTCN-3 (Extended Abstract). In: M. Hämmerli, B., Sommer, R. (eds) Detection of Intrusions and Malware, and Vulnerability Assessment. DIMVA 2007. Lecture Notes in Computer Science, vol 4579. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-73614-1_5

Download citation

  • DOI: https://doi.org/10.1007/978-3-540-73614-1_5

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-540-73613-4

  • Online ISBN: 978-3-540-73614-1

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation