Paper Presentation & Seminar Topics: ROOK: Multi-Session based Network Security Event Detector

ROOK: Multi-Session based Network Security Event Detector

Abstract:
We have implemented Multi-Session based Network Security Event Detector: ROOK to detect botnet activity and P2P file sharing traffic and our results show that our method is less false positives than existing network security event detectors (e.g. IDS). We proposed a network security event detection method by analyzing correlation among multiple sessions. Our method can recognize hosts behaviors by rules that describe multi-session correlations: a rule includes the order of starting sessions and information exchange between sessions. By this method, ROOK detected DNS and IRC activities of bots in the experiment.


Existing System
Existing SED’s methods mostly use features of a single session and a single packet as detection triggers.
Method 1: The first method is disguising malware traffic as innocent traffic.
Method 2: Using Encryption.
The software encrypts not only the contents but also the protocol headers to avoid detection. However the methods have problems distinguishing between malwares and P2P file sharing programs.

Proposed System
They proposed a network security event detection method by analyzing correlation among multiple sessions. Our method can recognize hosts behaviors by rules that describe multi-session correlations:
Hardware requirements:
Windows XP,2000
Hard disk:40GB
Processor Pentium4,1.33MHZ
RAM 512MB
LAN

Software requirements:
JDK1.6.0
Java run time environment