barns.blog

With 2009 already under-way, progress is happening in my Masters at a steady pace. With just under six months to go until the end of July, my work is in full swing, with a mixture of writing, algorithmic construction, testing and other activities. Over the next month, most of the development work should be completed. This is, of course, somewhat dependant on my teaching not getting too much in the way.

Thereafter, my algorithms and the sfPortscan algorithm from Snort will be tested and statistically analysed. Thereafter, I plan on finalising my write-up and handing in.

In the interim, I have plans to submit papers to several conferences during the course of the year, the first list includes ISSA, RAID, SATNAC, SAICSIT and CISSE (in chronological order of submission dates). I also hope to get a journal article out during the course of the year.

So, onward with 2009…

I spent the better part of my day working, I started by creating my Thesis and adding content for the Scan Types chapter. A simple copy paste of the SAICSIT paper into the newrucsthesis style took it to 18 pages. That’s 1/3 the length of my Honours Thesis! I also started working on my ISSA slides. These will be finished by Monday.

I didn’t book any actual shows for today, but decided that there were two things on the Fringe that I wanted to see, so booked for those. I have just come back from the first – The Spirit Lives, the other is at 20h30. I wondered down to the Village Green with Nick and booked tickets. Its definitely busier today than it was yesterday – but I reckon it will be at its busiest tomorrow and Sunday.

The Spirit Lives was also excellent, unfortunately there was a guy who answered his phone during the performance, and another who was videoing it with his phone. The actual performance was a Musical and it was a natural extension to yesterday’s theatre. It was about the Sharpville Massacre, but was a story of how the spirit of those who were slain is kept on through music. All our emotion is represented through music.

It was a good performance and enjoyed it along with the live music. The band was already on stage when I took my phone out to switch it off, so I took a photo. Its a crappy photo – my phones camera isn’t great – but its a photo nonetheless.

I have now submitted the camera-ready version of the ISSA Paper. It will be published under the title An Evaluation of Scan-Detection Algorithms in Network Intrusion Detection Systems.

Abstract:

Network Intrusion Detection Systems are becoming more prevalent as devices to protect a network. However, the methods they use for some forms of detection are flawed. This paper builds upon existing research by van Riel and Irwin which illustrated these flaws in Snort and Bro’s scan-detection engines. Indeed, it has been ascertained that a number of different scanning techniques are not identified by either Snort or Bro.

This paper highlights current research into the improvement of these scan-detection algorithms and presents insight into how this research is being conducted at Rhodes University. This research will improve on the scan-detection engines in Snort and Bro, permitting them to be used in a production environment without fear of succumbing to the false negative problem which currently exists.

As promised, ISSA got back to us today with the result of submissions to this years conference. My submission was accepted as a work in progress paper. It was submitted as a work in progress paper and so I am more than satisfied with the result.

It is also good to receive some feedback on the paper from the reviewers. Most notably, a discussion was given on the lack of discussion over the InetVis image, and the scope of the new work in relation to the related work section. Unfortunately, I feel that one of the reviewers did not consider the paper in the context of a work in progress submission and so not all of the feedback was useful.

Altogether a worthwhile result and so I guess a trip to JHB in July is now required…