@phdthesis{Rietz2017, author = {Rietz, Ren{\´e}}, title = {Optimization of network intrusion detection processes}, url = {http://nbn-resolving.de/urn:nbn:de:kobv:co1-opus4-44327}, school = {BTU Cottbus - Senftenberg}, year = {2017}, abstract = {Intrusion detection is a concept from the field of IT security. Network intrusion detection systems (NIDS) are used in addition to preventative measures, such as firewalls, to enable an automated detection of attacks. Network security threats often consist of multiple attack phases directed against various components of the network. During each attack phase, varying types of security-related events can be observed at various points in the network. Security monitoring, however, is nowadays essentially limited to the uplink to the internet. Sometimes it is also used to a limited extent at key points within a network, but the analysis methods do not have the same depth as at the uplink. Other areas, such as virtual networks in virtual machines (VMs), are not covered at all, yet. The aim of this thesis has been to improve the detection capability of attacks in local area networks. With a glance at the area of safety engineering, it appears efficient to secure these networks thoroughly and to develop additional monitoring solutions only for the remaining problem cases. This entails several challenges for the analysis of different parts of the TCP/IP stack. The lowermost part of the network stack has to be analyzed for attacks on network components, such as switches and VM bridges. For this, there is still no technology. Although attacks on the layers~2 and 3, such as ARP spoofing and rogue DHCP servers in physical networks, can be controlled to some extent by appropriate switches, equivalent methods are not used in virtual networks. Therefore, a software-defined networking based approach is proposed to counteract the respective attacks, which works for physical and virtual networks. The upper layers are already largely covered by traditional NIDS methods, but the rapidly increasing data rates of local area networks often lead to an uncontrolled discarding of traffic due to overload situations in the monitoring stations. Therefore, the drawbacks of current optimization approaches are outlined based on a detailed performance profiling of typical intrusion detection systems. A new approach for parallelizing the intrusion detection analysis that copes with the increasing network dynamics is introduced and evaluated. Since further special issues for NIDS particularly go back to the massive use of web technologies in today's networks, a firewall architecture is presented which applies novel NIDS methods based on machine learning to identify web applications and to ward off malicious inputs. The architecture addresses the entire process chain starting from the data transfer with HTTP via the analysis of manipulated web documents to the extraction and analysis of active contents.}, subject = {Intrusion Detection Systems (NIDS); Software-Defined Networking (SDN); Parallel NIDS; Web Firewall (Web 2.0); Machine Learning; Einbrucherkennungssysteme (IDS); Software-definierte Netzwerke (SDN); Web Firewall; Web 2.0; Maschinelles Lernen; Eindringerkennung; Maschinelles Lernen; Software-defined networking; World Wide Web 2.0; Firewall}, language = {en} }