Implementation of a stateful network protocol intrusion detection systems

S. Seng (1, 2, 3, 4, 5) , Joaquin Garcia‐alfaro (1, 4, 5, 3) , Y. Laarouci (2)

1 IP Paris - Institut Polytechnique de Paris
2 EDF R&D - EDF R&D
3 SCN-SAMOVAR - Sécurité et Confiance Numérique
4 TSP - Télécom SudParis
5 TSP - RST - Département Réseaux et Services de Télécommunications

The deployment of a Network Intrusion Detection System (NIDS) is one of the imperatives for the control of an information system. Today, almost all intrusion detection systems are based on a static vision of network exchanges, whether for detection engines based on signatures or on behavioral models. However, this approach is limited: it does not allow to directly take into account past exchanges and thus to fully model normal or abnormal behavior, such as verifying that an authentication has taken place before authorizing a privileged request or detecting a replay attack. We propose to add an additional dimension to NIDS by performing stateful monitoring of communication protocols. Unified Modeling Language (UML) statecharts have been chosen to model the protocols and to perform the stateful monitoring. An implementation of this solution is integrated within an existing NIDS and validated on two industrial protocols IEC 60870-5-104 and Modbus TCP. This implementation has been realiz ed by dissociating the stateful monitoring and the NIDS with the help of an abstraction interface allowing an easy integration of new communication protocols

Mots clés: Protocol Modeling; Intrusion Detection System; Anomaly Detection; Industrial System; Critical Infrastructures

Domaines: Cryptographie et sécurité [cs.CR]

S. Seng, Joaquin Garcia‐alfaro, Y. Laarouci. Implementation of a stateful network protocol intrusion detection systems. SECRYPT 2022 : 19th International Conference on Security and Cryptography, Jul 2022, Lisbon, Portugal. pp.398-405, ⟨10.5220/0011327400003283⟩. ⟨hal-03843013⟩