Rule Generalisation in Intrusion Detection Systems using Snort

Intrusion Detection Systems (IDSs) provide an important layer of security for computer systems and networks, and are becoming more and more necessary as reliance on Internet services increases and systems with sensitive data are more commonly open to Internet access. An IDS’s responsibility is to detect suspicious or unacceptable system and network activity and to alert a systems administrator to this activity. The majority of IDSs use a set of signatures that define what suspicious traffic is, and Snort is one popular and actively developing open-source IDS that uses such a set of signatures known as Snort rules. Our aim is to identify a way in which Snort could be developed further by generalising rules to identify novel attacks. In particular, we attempted to relax and vary the conditions and parameters of current Snort rules, using a similar approach to classic rule learning operators such as generalisation and specialisation. We demonstrate the effectiveness of our approach through experiments with standard datasets and show that we are able to detect previously undetected variants of various attacks. We conclude by discussing the general effectiveness and appropriateness of generalisation in Snort based IDS rule processing. Keywords: anomaly detection, intrusion detection, Snort, Snort rules

Rule Generalisation in Intrusion Detection Systems using Snort

Intrusion Detection Systems (IDSs) provide an important layer of security for computer systems and networks, and are becoming more and more necessary as reliance on Internet services increases and systems with sensitive data are more commonly open to Internet access. An IDS’s responsibility is to detect suspicious or unacceptable system and network activity and to alert a systems administrator to this activity. The majority of IDSs use a set of signatures that define what suspicious traffic is, and Snort is one popular and actively developing open-source IDS that uses such a set of signatures known as Snort rules. Our aim is to identify a way in which Snort could be developed further by generalising rules to identify novel attacks. In particular, we attempted to relax and vary the conditions and parameters of current Snort rules, using a similar approach to classic rule learning operators such as generalisation and specialisation. We demonstrate the effectiveness of our approach through experiments with standard datasets and show that we are able to detect previously undetected variants of various attacks. We conclude by discussing the general effectiveness and appropriateness of generalisation in Snort based IDS rule processing. Keywords: anomaly detection, intrusion detection, Snort, Snort rules

Accessing dental anxiety online support groups: An exploratory qualitative study of motives and experiences

Objectives: In recent years, Internet access has grown markedly providing individuals with new opportunities for online information retrieval, psychological advice and support. The objectives of the present study were to explore the context through which dentally anxious individuals access an online support group and the nature of their online experiences. Methods: An online questionnaire was completed by 143 individuals who accessed the Dental Fear Central online support group bulletin board. Qualitative analysis was conducted on the responses. Results: Analysis revealed three emergent themes which reflected the motives and experiences of individuals: ‘Searching for help’, ‘Sharing fears’ and ‘I feel empowered’. Conclusion: This exploratory study suggests that for most individuals accessing this online support group was a positive and beneficial experience. Practice Implications: Online support groups may represent a convenient and beneficial tool that may assist certain individuals to confront their debilitating anxiety/phobia and successfully receive dental care.

Social support in cyberspace: A content analysis of communication within a Huntington’s Disease online support group

Objective: Huntington’s Disease (HD) is an inherited disorder, characterised by a progressive degeneration of the brain. Due to the nature of the symptoms, the genetic element of the disease and the fact that there is no cure, HD patients and those in their support network often experience considerable stress and anxiety. With an expansion in Internet access, individuals affected by HD have new opportunities for information retrieval and social support. The aim of this study is to examine the provision of social support in messages posted to a HD online support group bulletin board. Methods: In total, 1313 messages were content analysed using a modified version of the Social Support Behaviour Code developed by Cutrona & Suhr (1992). Results: The analysis indicates that group members most frequently offered informational (56.2%) and emotional support (51.9%) followed by network support (48.4%) with esteem support (21.7%) and tangible assistance (9.8%) least frequently offered. Conclusion: This study suggests that exchanging informational and emotional support represents a key function of this online group. Practice implications: Online support groups provide a unique opportunity for health professionals to learn about the experiences and views of individuals affected by HD and explore where and why gaps may exist between evidence-based medicine and consumer behaviour and expectations.