WO2006082342A1 - Method and system for automatically detecting intrusions - Google Patents

Abstract

The invention concerns a method for detecting intrusions and an information system comprising an intrusion detecting probe (5) including an event sensor (5a) among a set of events to be monitored in the information system, an event being associated with at least one parameter taking on a value among a number of values, the probe (5) further comprises an analyzer (5b) designed to associate a subset of criteria among a set of predetermined criteria with a given parameter during a learning phase and to match during a validating phase the value taken by said given parameter to said subset of criteria, such that depending on whether said value fulfils or not said subset of associated criteria, said value is considered as valid or invalid.

Description

Title of the invention

Method and system for automatic detection of intrusions.

BACKGROUND OF THE INVENTION The invention relates to a method and system for automatic detection of intrusions according to a behavioral model.

The security of information systems involves the deployment of intrusion detection tools with intrusion detection probes. Indeed, the intrusion detection probes are active components that analyze one or more data sources in search of events characteristic of an intrusive activity and issue alerts to an alert management module. The latter centralizes the alerts coming from the probes and possibly carries out an analysis of all these alerts.

In general, the intrusion detection probes make it possible to update attacks (successful or not) against the information system according to an intrusion detection by scenario or by behavior. Scenario intrusion detection tools use signatures to recognize, and therefore characterize, attacks among a set of events. These signatures are mainly composed of an "active ingredient and the name of the signature that defines the alert to be issued." The active ingredient consists of a pattern, or a combination of patterns, which will be searched for among the events to monitor. The signatures used by the intrusion detection tools therefore make it possible to associate an alert name with a recognized event by virtue of the "active principle" of these signatures. In the context of scenario-based intrusion detection, these signatures are used to characterize attacks. In addition, behavioral intrusion detection is an intrusion detection method making it possible to update intrusive behaviors by comparing the use of the resources of an information system with a reference behavior known as a behavior model.

The reference behavior is created from the observation of a set of events considered as healthy. This phase is called the learning phase. A certain amount of information can be extracted during this phase to be used to create the behavior model.

The reference behavior and the behavior to be monitored may consist of different types of events and / or measures. A behavioral intrusion detection module can, for example, monitor the bandwidth used, CPU consumption, or commands executed by the system.

In the field of behavioral intrusion detection, a method proposed by C. Kruegel et al. in a publication "Proceedings of the 8f ^pm European Symposium on Research in Computer Security 326-343 pages, in October 2003, Springer-Verlag", entitled "On the Detection of Anomalous System CaII Arguments." This method makes it possible to take into account the values of the parameters of the system calls for the behavioral intrusion detection applied in particular to the parameters of the requests sent to web servers. More specifically, the author presents methods for characterizing the values taken by these parameters according to the length of the parameter values, the character distribution in the parameter values, the structure of the parameter values, the recognition of enumerated types, and the presence of the parameter value.

The disadvantage of this method is that it does not make it possible to characterize the values taken by parameters according to characters or qualitative constraints that can not be quantified. Thus, it can only be used for a limited number of criteria.

OBJECT AND SUMMARY OF THE INVENTION The object of the invention is to remedy these drawbacks, and to provide a system and a simple method for automatic detection of intrusions with great precision.

These goals are achieved by an automatic intrusion detection method among a set of events to be monitored, an event being associated with at least one parameter taking a value among a plurality of values, the method comprising: a phase of learning comprising associating a subset of criteria with a given parameter, said subset of criteria being selected from a set of predetermined criteria; and a validation phase comprising confronting the value taken by said given parameter with said subset of criteria defined during the learning phase, such that whether said value satisfies said subset of associated criteria or not, then said value is considered valid or invalid. Thus, the fact that the criteria can be previously established makes it possible to develop an unlimited number of criteria and therefore to reinforce the characterization of the parameters during the learning phase in order to use these criteria during the validation phase to detect intrusions automatically and with optimal accuracy. The set of predetermined criteria can be constructed by a human operator to respond to problems encountered in an information system.

Thus, the predetermined criteria are constructed in a simple manner without probabilistic or other calculations and are completely dissociated from the values taken by the parameters. Advantageously, said invalid value generates an alert corresponding to the event associated with said given parameter having this invalid value.

Thus, each alert issued is specific because it points directly to the parameter and its invalid value as well as to the invalidating criterion.

According to one particularity of the invention, the learning phase comprises the following steps:

associating with said plurality of values a plurality of first subsets of criteria, a first subset of criteria being associated with a corresponding value of said plurality of values, and constructing the set common to said plurality of first sub-sets of criteria; sets of criteria for forming said subset of criteria associated with said given parameter. Thus, associating a set that can include an unlimited number of criteria external to each of the values makes it possible to increase the accuracy of the characterization of the values and therefore of the parameters.

According to one embodiment of the invention, the method comprises the organization of a plurality of criteria determined in a hierarchical structure comprising several levels defined according to a partial order relationship so that each criterion corresponds to a node of said structure hierarchical.

Thus, the hierarchical structure makes it possible not to test all the criteria in a systematic manner and therefore to increase the speed and effectiveness of the intrusion detection as well as the learning phase.

A first subset of criteria corresponds to a first path traversing the hierarchical structure from its root to the last child node whose criterion is satisfied by said value corresponding one taken by said given parameter, the plurality of first subsets of criteria thereby forming a plurality of first paths.

Thus, the first subset of criteria can be determined by minimizing the number of tests.

In addition, the subset of criteria associated with said given parameter corresponds to a common path extracted from a path common to said plurality of first paths.

Thus, the subset of criteria associated with the given parameter can be constructed simply and quickly.

The invention also relates to an intrusion detection probe comprising an event sensor among a set of events to be monitored in an information system, an event being associated with at least one parameter taking one of a plurality of values the probe further comprises an analyzer for associating, during a learning phase, a subset of criteria to a given parameter, said subset of criteria being chosen from among a set of predetermined criteria, and to be compared when a validation phase the value taken by said given parameter to said subset of criteria, so that whether or not said value satisfies said subset of associated criteria, then said value is considered valid or invalid.

Thus, by strengthening the characterization of the parameters during the learning phase, the intrusion detection probe allows automatic detection of intrusions with great precision and optimal efficiency.

Advantageously, the probe is intended to issue an alert to a management module, said alert corresponding to the event associated with said given parameter taking said invalid value and the criterion not validated. Thus, each alert emitted by the probe indicates the parameter and its invalid value and the non-validated criterion.

The invention also proposes a monitored information system comprising a plurality of intrusion detection probes according to the above characteristics and an alert management module comprising an alarm presentation console.

Thus, an effective and precise automatic detection of the intrusions makes it possible to reinforce the protection of the information system.

Brief description of the drawings

Other features and advantages of the invention will appear on reading the description given below, by way of indication but not limitation, with reference to the accompanying drawings, in which:

FIG 1 is a very schematic view of a monitored information system comprising an intrusion detection system according to the invention;

FIGS. 2A and 2B are flow charts for the construction of the subsets of criteria according to a first embodiment of the invention; FIG. 3 very schematically shows an example of a simplified hierarchical structure of the predetermined criteria according to the invention; and

FIGS. 4A and 4B are flow charts for the construction of the subsets of criteria according to a second embodiment of the invention.

Detailed description of embodiments

FIG. 1 illustrates an example of a monitored information system 1 comprising an intrusion detection system 3 comprising several intrusion detection probes 5 and an alert management module 7.

Thus, the intrusion detection probes 5 monitor events from outside or inside a network of the monitored information system which includes workstations 9 and servers 11 communicating with external networks ( not shown).

The alert management module 7 may include a host 7a dedicated to the processing of alerts and a 7b console for presenting alerts. According to the invention, each intrusion detection probe 5 comprises an event sensor 5a and an analyzer 5b.

The event sensor 5a monitors a set of events occurring in the information system 1. In general, an event is an action on the information system 1 which may contain one or more parameters. Thus, a given event may be associated with a given parameter taking one of a plurality of values.

For example, an event may correspond to an http request which consists of a client requesting a resource from a server 11. This event can be traced in the log file of the server 11. An http request extracted from a log file line can be of the following form: GETT /index.php? id = UPZB7456.

In this example, the client requests the resource designated by

"/Index.php" by passing the parameter "identifier" which has the value "UPZB7456".

In addition, the probe 5 comprises an analyzer 5b for associating a subset of criteria from a set of predetermined criteria to a given parameter during a learning phase.

By way of example, a first criterion C1 can be defined as follows: "the value has a length of less than six characters". A second criterion C2 can be defined as follows: "the value is composed of four capital letters and four digits".

In addition, the analyzer 5b of the probe 5 is intended to confront, during a validation phase, the value taken by the parameter given to the subset of criteria, so that, depending on whether or not the value satisfies this subset, set of associated criteria, then the value is considered valid or invalid.

Thus, according to the examples of the event and the criteria C1, C2 defined above, the value of the parameter "identifier" satisfies criterion C2 but does not satisfy criterion C1.

In general, the alert corresponding to the event associated with the given parameter taking the invalid value is sent (arrow 13) by the probe 5 to the management module 7.

{l,-- -rc}} de n critères. Cet ensemble C de critères prédéterminés peut être construit par un opérateur humain, par exemple par l'intermédiaire de la console 7b, de façon à répondre aux problèmes rencontrés dans le système d'information 1. Prenons pour exemple un paramètre qui prend pour valeur du code XML, P = <user name="Elvis Tombini" id="501"> quelques commentaires </user>. Ici, Ia valeur du paramètre P doit être du code XML bien formé c'est-à-dire, la valeur doit se conformer aux standards XML définis par le W3C (par exemple, une balise ouvrante est associée à une balise fermante correspondante, les valeurs de paramètre XML doivent être entre guillemets etc.).The method according to the invention thus consists in automatically detecting any intrusion among a set of events to be monitored in the information system 1. An event may be associated with at least one parameter taking one of a plurality of values. Indeed, a given parameter P can take a value v, from among a set V = {v ,, the {l, --- /}}} of values. This process comprises two phases, a learning phase and a validation phase. The learning phase comprises associating a subset C _p of criteria with a given parameter. The subset C _p of criteria is chosen from a set C of predetermined criteria, for example a set C

{l, - -rc}} of n criteria. This set C of predetermined criteria can be constructed by a human operator, for example via the console 7b, so as to respond to the problems encountered in the information system 1. Take for example a parameter that takes the value of the XML code, P = <user name = "Elvis Tombini" id = "501"> some comments </ user>. Here, the value of the parameter P must be well-formed XML, that is, the value must conform to the XML standards defined by the W3C (for example, an opening tag is associated with a corresponding closing tag, the XML parameter values must be enclosed in quotation marks etc.).

According to this example and in accordance with the invention, it is possible to define the following set of criteria that this value of the parameter P must satisfy:

- the value starts with the character "<";

- the value starts with an opening XML tag;

- the value ends with a closing XML tag;

- the hierarchical structure of the XML tags is respected; - The parameter values of XML elements are enclosed in quotation marks.

All these criteria can be expressed in the form of "pattern matching" when these criteria are associated with the parameter P.

The predetermined criteria can thus be constructed in a simple manner and completely dissociated from the values taken by the parameters.

Moreover, thanks to the fact that these criteria are previously established, this makes it possible to develop an unlimited number of criteria and thus to reinforce the characterization of the parameters during the learning phase. This makes it possible to use these characteristics, during the validation phase, to detect the intrusions automatically and with optimum efficiency and accuracy.

Indeed, during the validation phase, each value v, taken by the given parameter P is confronted with a subset C _p of associated criteria. If the value v satisfies this subset C _P of criteria, then this value v _; is considered valid. If it does not satisfy this subset C _p of criteria, it is not considered valid and an alert corresponding to the event associated with the given parameter having this invalid value is sent (arrow 13) to the management module 7.

According to the invention, FIGS. 2A to 4B show different embodiments of the learning phase.

In general, the learning phase comprises a first step for associating with the plurality of values, a plurality of first subsets of criteria. So, a first subset

C _vl = {c _j , I \ [, --- l}: c _j → v,} of criteria can be associated with each of the values v, taken by the given parameter P to form the plurality C _v = {C, , _; , / e {l, - m}} of first subsets of criteria, where each first subset C _v! of criteria is associated with a corresponding value v.

The learning phase further comprises a second step of constructing a set common to the plurality C _v of first subsets of criteria in order to form the subset of criteria C _p associated with the given parameter P. Then, in order to characterize parameters from a set C of predetermined criteria, we seek to construct a first subset C ₁ ,, for each value v, before constructing the subset C _p of criteria associated with the given parameter P.

2A and 2B comprise very schematic diagrams illustrating a first embodiment for the construction of subsets C and C _{P vl} respectively. In step E1, we define a set C = {C,, ZG {1, - - R}} of n criteria and consider that the first subset C _v1 of criteria associated with a given value v is initially empty.

Steps E2 to E5 form a loop satisfying for each criterion c, with i = l, ---, n if v, satisfied, then C _{v /} = C _{V /} u {c,}.

More particularly, the step E2 is an iterative test verifying if the n predetermined criteria of the set C have been traversed. Thus, if the index i denoting the criterion c, is less than or equal to n (that is to say i≤n) then step E3 is taken. Step E3 is a test intended to check whether the value v, satisfies the criterion c,. If the result of the test is positive, that is, if v satisfies criterion c, then step E4 where criterion c is added to the first subset C _v1 of criteria associated with the value v, that is to say C _{v /} = C _{v /} u {c,}. On the other hand, if the result of the test E3 is negative, then we go to the step E5 where we increment the index i (/ = / +1) before looping back to the step E2.

Finally, if all the criteria of the set C have been traveled, that is to say if the index / test E2 is not less than or equal to n, then we go to step E6 to return the first subset

C _w criteria associated with the value v,.

Thus, the flow chart of FIG. 2A shows that each first subset C _w of criteria comprises the criteria satisfied by the corresponding value v, taken by the given parameter P. Then, for the set F = {v ,, / e {., ••• / "}} of the values taken by the given parameter

P ₁ the flowchart of Figure 2A allows to associate with each value v, a first subset of criteria C _v! to form a plurality C _κ = {C _{v /} , / e {l, --- m}} of first subsets of criteria associated with the values of the set V taken by the given parameter P.

The construction of the subset C _p of criteria associated with the given parameter P is illustrated by the flowchart of FIG. 2B. In step E7, we define the plurality C _v = {C _{v /} , / e {l, - ••? "}} Of first subsets of criteria constructed by the preceding flowchart and it is considered that the subset set C _p of criteria associated with the given parameter P is initially equal to C _n (C _p = C _vl ) and we start with the index 1 = 2. The steps E8 to ElO form a loop traversing the plurality

C _v = {C _vl , the \ [, - ->}} of first subsets of criteria to form the subset C _p of criteria associated with the given parameter P as being the set of common criteria associated with the values taken by this given parameter P. More particularly, step E8 is an iterative test verifying whether the first m subsets of criteria C _v1 have been traversed. Thus, if the index / designating the first subset of criteria C _v , is less than or equal to m (I ≤ m) then step E9 is taken.

In step E9, it is iteratively constructed the subset C _p criteria associated with the given parameter P by forming the intersection between the first subsets of criteria, that is to say C _p = n _{/ 6 {} , _m} C _vl . Then, we go to step ElO to increment the index

/ (/ = / +1) before looping back to step E8.

Finally, if all the first m subsets of criteria C _vl have been traversed, that is, if the index / test E8 is not less than or equal to m, then we proceed to step EIl to return the subset C _p of criteria associated with the given parameter P. Figures 3 to 4B illustrate another embodiment for the characterization of a given parameter.

Indeed, FIG. 3 shows that a plurality of determined criteria C = {c ₁ , ie {θ, -n}} (according to this simplified example n = 6) can be organized in a hierarchical structure or characterization tree A = [N ₁ I {θ, --- n}} having several levels defined according to a partial order relation (noted - <) so that each criterion c, corresponds to a node N, of this hierarchical structure.

The root of the tree is represented by the node N ₀ which conventionally is associated with a null criterion and with each node N, is associated a criterion c, -

In addition, by construction, the criteria associated with the child nodes N _n , N ₁₂ , ..., N _{t 1} of a node N, are exclusive. Thus, if an element satisfies a criterion c _lk , associated with a node N _lk , it does not satisfy any criterion associated with the sibling nodes.

Let N, and N _{1 be} two nodes of the characterization tree, then we denote N, - <N ₇ if there exists a path in the characterization tree between the nodes N, and N _; and if N, is an ancestor of N,. In practice, if N, and N _j satisfy the partial order relation <then they belong to the same branch of the characterization tree.

The relation N, ^ N ₇ can also be written N, ^ N ₁₁ - <... N _lk <... <N _j where the N, _{te {} , _{/ j} are the set of nodes, satisfying the relation <, which form the path in the characterization tree between the nodes N, and

N _j . The construction of the subset C _v1 is illustrated by the flowchart of FIG. 4A where for a given parameter P and the set of its values V = {v _l , the $, --- m}}, one traverses for each value V ₁ , the tree of characterization since the root by testing the criterion associated with each node.

Each first subset C ₁₁ of criteria corresponds to a first path traversing the hierarchical structure from its root to the last child node whose criterion is satisfied by the corresponding value v, taken by the given parameter P. Thus, the plurality of first subsets of criteria form a plurality of first paths. More particularly, the step E21 is an initialization in which the characterization tree corresponding to the set C = {c ₁ , ie {θ, - - n}} of n predetermined criteria is defined and, to begin, one initializes the index / 0 = 0). Moreover, it is considered that the first subset C _{v /} of criteria associated with a given value V ₁ is initially empty.

In step E22, if, for a node N, the value v, satisfies the criterion c ,, then the criterion c is added to the subset C _v of criteria associated with the value v, (step E23 ), i.e. C _v1 = C _v1 u {c,} and proceed to step E24. Step E24 is a test to check if node N ₁ has a child node N _k . If yes, then step E25 where the index / the value k (i = k) is assigned before looping back to step E22.

If the result of the test of step E22 is negative, that is to say that the value v does not satisfy criterion c _; then go to step E27. Step E27 is a test to check if node N, has a sister node N _h . If so, that is to say if the node N has a brother node N ,, then we go to step E28 where the index / the value h (i = h) is assigned to to loop back to step E22. On the other hand, if the result of the test E24 or that of the test E27 is negative, then step E29 is carried out to return the first subset C _{v /} of criteria associated with the value v,.

Thus, if for a node N ₁₁ the value v satisfies the criterion C ₁ but does not satisfy any of the criteria of its child nodes or if there is no child node, the path between N ₀ and N 1. characterizes the value v,.

The set of criteria associated with the value v, is the union of the criteria satisfied by this value from the root N ₀ of the classification tree up to the node N, inclusive, ie C _vl ≈ ^ j _NkSNa ^ _N C _k . It will be noted that, by construction of the characterization tree, a value v can traverse only one branch.

des valeurs prises par un paramètre donné P , est associé un ensemble de critères C_vl selon l'organigramme de la figure 4A. On noteFIG. 4B is a flowchart illustrating the construction of the subset C _p of criteria associated with the given parameter P and whose principle is the same as that of FIG. 2B. Indeed, at each value v, of the set V

values taken by a given parameter P, is associated a set of criteria C _vl according to the flowchart of FIG. 4A. We notice

C _y = {C _{v /} , / e {l, --- w}} the plurality of first subsets of criteria associated with the values taken by the parameter P. Then, as before, the subset of criteria associated with the given parameter

P is the common set of this plurality of subsets

(C _p = n _{/ e} { _[m } C _{v /} ).

However, in view of the tree structure used, two cases must be considered. If c _vm = c _v; That is to say if the values v _m and _w satisfy the same criteria and thus give rise to the same course in the characterization of tree, then _mι c n _m c = _YM. On the other hand, if c _vm ≠ c _vn , that is, if the values v _m and v _n do not satisfy the same criteria, and therefore do not give rise to the same path in the characterization tree, then we can extract a subset of criteria common to c _vm and c _m and therefore a common path in the characterization tree. In this case, we extract a subset of criteria satisfying the two values v _m and v ,, from their common path in the characterization tree.

In other words, the subset C _p of criteria associated with the given parameter corresponds to a common path extracted from a path common to the plurality of first paths.

Indeed, FIG. 4B shows that in the non-trivial case where c _vm ≠ c _vn , step E9 may comprise steps E91 to E95.

In step E91, the path N ₀ ~ <N is defined _; in the characterization tree bound to Q _/ (C _{v /} = u ^^^ C _k ) and the path N ₀ - <N _f in the characterization tree bound to C _p (C _P = u _NkSN ^ _Nr C _k ). In addition, we define a set R of criteria initially empty, corresponding to the path traveled in the tree and we start to browse this tree from the root (N _k = N ₀ ).

Step E92 is a test to check if there is a node N, such that N _k - <N _n N ₁ - <N _V and N, - <N _r and such that none of the child nodes of N _; does not fulfill this condition.

If the result of the test E92 is positive, then proceed to step E93 where the path N _k - <N ₁ is added to the path associated with the set R, that is to say R = R u \ J _NqβNt ^ _m C _q . At step E94, node N (N _fc = N) is passed before looping back to step E92. On the other hand, if the result of the test E92 is negative, then we go to the step E95 where we return the subset C _p of criteria associated with the given parameter which then corresponds to the set R (C _p = R ).

Claims

A method of automatically detecting intrusions among a set of events to be monitored, an event being associated with at least one parameter taking one of a plurality of values, the method being characterized in that it comprises: a learning phase comprising an association of a subset of criteria from a set of predetermined criteria to a given parameter; and a validation phase comprising confronting the value taken by said given parameter with said subset of criteria defined during the learning phase, such that whether said value satisfies said subset of associated criteria or not, then said value is considered valid or invalid. 2. Method according to claim 1, characterized in that said invalid value generates the emission of an alert corresponding to the event associated with said given parameter taking this invalid value. 3. Method according to claim 1, characterized in that the learning phase comprises the following steps: associating with said plurality of values a plurality of first subsets of criteria, a first subset of criteria being associated with a corresponding value of said plurality of values, and constructing the set common to said plurality of first sub-sets of criteria; sets of criteria for forming said subset of criteria associated with said given parameter. 4. Method according to claim 3, characterized in that it comprises the organization of a plurality of criteria determined in a structure hierarchical structure comprising several levels defined according to a partial order relationship so that each criterion corresponds to a node of said hierarchical structure. 5. Method according to claim 4, characterized in that a first subset of criteria corresponds to a first path traversing the hierarchical structure from its root to the last child node whose criterion is satisfied by said corresponding value taken by said given parameter, the plurality of first subsets of criteria thus forming a plurality of first paths. 6. Method according to claim 5, characterized in that the subset of criteria associated with said given parameter corresponds to a common path extracted from a path common to said plurality of first paths. 7. Intrusion detection probe (5) having an event sensor (5a) among a set of events to be monitored in an information system, an event being associated with at least one parameter taking a value among a plurality of values, the probe being characterized in that it further comprises an analyzer (5b) intended to associate a subset of criteria from a set of predetermined criteria to a given parameter during a learning phase and to confront during a validation phase, the value taken by said given parameter to said subset of criteria, such that whether or not said value satisfies said subset of associated criteria, then said value is considered valid or invalid. 8. Probe (5) according to claim 7, characterized in that it is intended to issue an alert to a management module (7), the alert corresponding to the event associated with said given parameter taking said invalid value. A monitored information system comprising an alert management module (7) comprising an alert presentation console (7B), characterized in that the information system further comprises a plurality of detection probes (7B). intrusions according to any one of claims 7 and 8.