Defining categories to select representative attack test-cases

Mohammed Gad El Rab (1) , Anas Abou El Kalam (2) , Yves Deswarte (1)

1 LAAS-TSF - Équipe Tolérance aux fautes et Sûreté de Fonctionnement informatique
2 IRIT-RMESS - Réseaux, Mobiles, Embarqués, Sans fil, Satellites

To ameliorate the quality of protection provided by intrusion detection systems (IDS) we strongly need more effective evaluation and testing procedures. Evaluating an IDS against all known and unknown attacks is probably impossible. Nevertheless, a sensible selection of representative attacks is necessary to obtain an unbiased evaluation of such systems. To help in this selection, this paper suggests applying the same approach as in software testing: to overcome the problem of an unmanageably large set of possible inputs, software testers usually divide the data input domain into categories (or equivalence classes), and select representative instances from each category as test cases. We believe that the same principle could be applied to IDS testing if we have a reasonable classification. In this paper we make a thorough analysis of existing attack classifications in order to determine whether they could be helpful in selecting attack test cases. Based on our analysis, we construct a new scheme to classify attacks relying on those attributes that appear to be the best classification criteria. The proposed classification is mainly intended to be used for testing and evaluating IDS although it can be used for other purposes such as incident handling and intrusion reporting. We also apply the Classification Tree Method (CTM) to select attack test cases. As far as we know, this is the first time that this method is applied for this purpose.

Mots clés: classification.; Test; Evaluation; Attack; Intrusion Detection Systems; classification

Domaines: Cryptographie et sécurité [cs.CR]

Mohammed Gad El Rab, Anas Abou El Kalam, Yves Deswarte. Defining categories to select representative attack test-cases. 2007. ⟨hal-00168602v2⟩