NetHost-Sensor: Investigating the Capture of End-To-End Encrypted Intrusive Data
Buchanan, W. (2006). NetHost-Sensor: Investigating the Capture of End-To-End Encrypted Intrusive Data. Computers & Security, 25, (6), 445-451.
Intrusion Detection Systems (IDSs) are systems that protect against violation of data integrity, confidentiality and availability of resources. In the past 20 years, these systems have evolved with the technology and have become more sophisticated. Despite these advances, IDS is still an immature field, and the benefits obtained from detecting end-to-end encrypted attacks justify the need for more research.
This paper presents possible advantages of an IDS that uses a target host's kernel as its audit source for intrusion analysis against specific attacks. In addition, we describe our research experience in determining what layer, within a protocol stack of a target host, where decrypted data can be captured for intrusion detection. Then, it examines how to capture decrypted data, while communicating via an End-to-End (ETE) encryption channel. The paper proceeds further to discuss our methodology using network communication driver interfaces, investigative experimental procedures and present our experimental results. Finally, discussions on the methodology of our future research, modelling HTTP network data via procedure analysis technique to reduce false positive rate of attacks are presented.
Director of CDCS
+44 131 455 2759
Areas of Expertise
See all areas of expertise
Electronic information now plays a vital role in almost every aspect of our daily lives. So the need for a secure and trustworthy online infrastructure is more important than ever. without it, not only the growth of the internet but our personal interactions and the economy itself could be at risk.