Experimenting with an Intrusion Detection System for Encrypted Networks. (28th January 2010)

• Record Type: Journal Article
• Authors: Goh, Vik Tor; Zimmermann, Jacob; Looi, Mark
• Is Part Of: International journal of business intelligence and data mining. Volume 5:Number 2(2010)
• Page Start: 172
• Page End: 191
• Publication Date: 2010-01-28
• Subjects: NIDS -- network-based intrusion detection systems -- encrypted networks -- VPN -- virtual private networks -- IPsec -- IP security -- Shamir&#39 -- s secret sharing -- SNORT -- malicious activity; 006.312
• Languages: English
• ISSNs: 1743-8187

Abstract

Network-based Intrusion Detection Systems (NIDSs) analyse network traffic to detect instances of malicious activity. Typically, this is only possible when the network traffic is accessible for analysis. With the growing use of Virtual Private Networks (VPNs) that encrypt network traffic, the NIDS can no longer access this crucial audit data. In this paper, we present an implementation and evaluation of our approach proposed in Goh et al. (2009). It is based on Shamir's secret-sharing scheme and allows a NIDS to function normally in a VPN without any modifications and without compromising the confidentiality afforded by the VPN.