Anomaly-based intrusion detection: privacy concerns and other problems

Abstract

This paper addresses the specific advantages and disadvantages of anomaly-based intrusion detection. One important disadvantage is its impact on user privacy. A great deal of potentially sensitive information is recorded and analyzed in ways that threaten personal integrity. A solution for this may be to pseudonymize the sensitive information in the log files, i.e., exchange user names, etc., for pseudonyms. This paper shows how this can be done. We have carried out a number of experiments using an anomaly detection tool on pseudonymized data collected from a proxy firewall. The experiments revealed most of the known problems of anomaly detection and also some problems originating from the use of intrusion detection in combination with pseudonymization. This paper focuses on these problems and discusses how they can be remedied or circumvented. Also discussed is the extent to which these problems apply to tools based on misuse detection.

Introduction

A large number of intrusion detection tools have been designed and implemented during the past two decades. The first ones were anomaly detection tools, but today misuse detection tools dominate the market together with some hybrid versions. Some early systems are IDES [9], Haystack [16] and MIDAS [17]. More recent systems are, e.g., Emerald [14] and Bro [13].

Anomaly detection means establishing a “normal” behavior pattern for the users of the system and then looking for deviations from this behavior. An early anomaly detection model is described by Denning [3]. Research efforts on anomaly detection have resulted in systems such as NIDES [7] and W&S [18].

The feature of anomaly detection that makes it interesting to use is the possibility of detecting formerly unknown intrusions. The most apparent drawback of anomaly detection is the high false alarm rates. The question is if this is an unsolvable problem that will render anomaly detection useless.

Misuse detection means looking for known malicious or unwanted behavior. Examples of misuse detection systems are Haystack [16] and Bro [13].

The main features of misuse detection are its efficiency and comparably low false alarm rate and these qualities are important to the customers. The problem is that new intrusions appear frequently and there is a race between upgrading the intrusion detection system (IDS) and attackers finding new ways of getting into the systems. This is a race that cannot be won by the system owners.

Many different intrusion detection prototypes have been studied and tested during the years. Most studies focus on the advantages of the method and not many address the limitations and practical problems.

There are many different characteristics that must be taken into consideration when studying IDSs. Of course, the detection rate is one of these. Detection rate means the percentage of “all possible” intrusions that will be detected. The false alarm rate may be even more important, especially since it seems to be a limiting factor in what methods can be used in practice [1]. Besides that, there are characteristics such as timeliness, what data sources that are used, if the detection is distributed, privacy aspects, etc. Such characteristics have been surveyed and classified in a number of papers, e.g., [2], [4].

We designed and implemented an anomaly detection tool in a recent industrial project. Since we were interested in the features of anomaly detection, we wanted to make a practical evaluation of the usefulness of the method. The goal of our work was to describe the problems experienced and to suggest possible solutions to them. We realized at an early stage that user privacy would be one important problem. We therefore developed a pseudonymization tool that removes sensitive information from log files and uses pseudonyms for user names, host names, etc. Anomaly detection experiments were then performed on pseudonymized data collected from a proxy firewall [11].

In the following, Section 2 discusses background and related work within anomaly detection and privacy in computer systems. Section 3 discusses sensitive information and how to protect privacy with pseudonymizers. In Section 4, the implementation of our pseudonymizer is described. The implementation of the anomaly detection tool is described in Section 5, and the experiments in Section 6. Experienced problems and possible remedies are discussed in Section 7. Section 8 presents a short discussion of how these problems apply to misuse detection tools and Section 9 some concluding remarks.