TRABAJO DE FIN DE GRADO EN INGENIERÍA INFORMÁTICA
P i a e Ne wo ks In usion
De ec ion Sys em by Sa is ying
Ne wo k Cons ain s
F ancisco Ga cía Ma ínez
Di ec ed by: Thomas Dean
Co-di ec ed by: José Luis Vázquez-Pole i
08/06/2017
TASSEP PROGRAM
Facul y o Enginee ing and Applied Science
Queen’s Uni e si y o Canada
&
Facul ad de In o má ica
Uni e sidad Complu ense o Mad id
2
3
Acknowledgemen s
I wan o exp ess my since e g a i ude o D . Thomas R. Dean,
Associa e P o esso o Queen’s Uni e si y’s Elec ical &
Compu e Enginee ing Depa men and di ec o o his huge
and amazing p ojec , wi hou whom any o his would ha e e e
been possible.
Thanks o all my p ojec eam membe s o hei pa ience and
kindness h oughou his yea , special men ion o Siam Hasan
and Ali ElShakanki y.
Also, special hanks o my co-di ec o in Spain, D . José Luis
Vázquez-Pole i, Associa e P o esso o Complu ense Uni e si y’s
Compu e A chi ec u e and Au oma ion Depa men , o his
suppo , help and a ailabili y.
This esea ch p ojec is unded in pa by he Na ional Science
and Enginee ing Resea ch Council o Canada (NSERC) and he
Depa men o Na ional De ense (DND), Canada.
4
5
Abs ac
The g ea de elopmen o newe echnologies also ca ies an impo an g ow h in he
numbe o malicious a acks [
1
]. E en p i a e ne wo ks wi hou ex e nal In e ne
connec ions su e om hose a acks. These p i a e ne wo ks play a c ucial ole in he
coun y’s secu i y. Imagine he consequences o u ning he powe o an en i e ci y
down o a denial o se ice [
2
] in an ai a ic con ol sys em. Because o his ac ,
nume ous poli icians, including he ecen ly named Uni ed S a es o Ame ica’s
p esiden , Donald T ump, a e se iously aking in o conside a ion he huge impo ance o
p o ec ing he p i a e ne wo ks om in usions in o de o assu e hei coun ies’ peace.
Some people e en belie e ha e icien In usion De ec ion Sys ems (IDS) [
3
] could be
a good p o ec ion agains a possible Thi d Wo ld Wa . Thus, new and mo e powe ul
secu i y solu ions need o be de eloped o p o ec ou o ganiza ions’ sys ems.
Key wo ds: In usion De ec ion Sys em (IDS), Da a Dis ibu ion Se ice (DDS), Real-
Time Publish-Subsc ibe P o ocol (RTPS), p i a e ne wo ks, in usions, cons ain
engine, ne wo k cons ain s, ees.

6
Resumen
El g an desa ollo de las nue as ecnologías conlle a ambién un aumen o conside able
en el núme o de a aques maliciosos [1]. Incluso las edes p i adas sin conexión ex e na
a In e ne su en es os a aques. Es as edes p i adas juegan un papel c ucial en la
segu idad de cada país. Imagínense las consecuencias de i a abajo la co ien e eléc ica
de una ciudad en e a o una denegación de se icio [2] en un sis ema de con ol aé eo.
Debido a es e hecho, nume osos polí icos, incluido el ecien emen e nomb ado
p esiden e de los Es ados Unidos de Amé ica, Donald T ump, es án concienciándose
se iamen e de la eno me impo ancia que supone p o ege las edes p i adas en e a
in usiones pa a asegu a la paz en sus países. Alguna gen e c ee incluso que unos
Sis emas de De ección de In usiones (IDS) [3] e ec i os pueden se una buena medida
de p o ección an e una posible Te ce a Gue a Mundial. De es a o ma, nue as y más
po en es medidas de segu idad ienen que desa olla se pa a p o ege los sis emas de
nues as o ganizaciones.
Palab as cla e: Sis ema de De ección de In usiones (IDS), Se icio de Dis ibución
de Da os (DDS), P o ocolo de Publicación-Subsc ipción en Tiempo Real (RTPS), edes
p i adas, in usiones, mo o de es icciones, es icciones de ed, á boles.
7
8
Glossa y
• ABS: Anomaly-Based Sys em
• ATC: Ai T a ic Con ol
• DAG: Di ec ed Acyclic G aph
• DDS: Da a Dis ibu ion Se ice
• DoS: Denial o Se ice
• DDoS: Dis ibu ed Denial o Se ice
• DPI: Deep Packe Inspec ion
• IDS: In usion De ec ion Sys em
• IGMP: In e ne G oup Managemen P o ocol
• NIDS: Ne wo k In usion De ec ion Sys em
• OMG: Objec Managemen G oup
• PCAP: Packe cap u e
• QoS: Quali y o Se ice
• RTPS: Real Time Publish-Subsc ibe P o ocol
• SBS: Signa u e-Based Sys em
• SCL: Syn ax Cons ain Language
9
Glosa io
• ABS: Sis ema Basado en Anomalías
• ATC: Con ol de T á ico Aé eo
• DAG: G á ico Acíclico Di igido
• DDS: Se icio de Dis ibución de Da os
• DoS: Denegación de Se icio
• DDoS: Denegación de Se icio Dis ibuida
• DPI: Inspección P o unda de Paque es
• IDS: Sis ema de De ección de In usiones
• IGMP: P o ocolo de Ges ión de G upos en In e ne
• NIDS: Sis ema de De ección de In usiones en Redes
• OMG: G upo de Ges ión de Obje os
• PCAP: Cap u a de Paque es
• QoS: Calidad del Se icio
• RTPS: P o ocolo de Publicación-Subsc ipción en Tiempo Real
• SBS: Sis ema Basado en Fi mas
• SCL: Lenguaje de Sin axis de Res icciones
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
16
1.2. Me hod
We a e i s ly explo ing he men ioned amewo k using wo p o ocols: In e ne
G oup Managemen P o ocol (IGMP) [
7
] and Real Time Publish and Subsc ibe
P o ocol (RTPS) [
8
], being his las one based in he Da a Dis ibu ion Se ice
(DDS) mechanism [
9
]. DDS p o ides e ec i e suppo and secu i y o c i ical
se ices, such as ai a ic con ol managemen o inancial ading. Hence, we s a
ocusing ou esea ch on hese p o ocols because hey migh be used by he kind o
applica ions o wha we a e aiming ou app oach. Bu , once ou p og am is
p ope ly wo king wi h hese wo p o ocols, ou inal goal is o build a so wa e able
o wo k among any p o ocol de ined, allowing i o, once gi en he p o ocol’s
de ini ion using a speci ic language ha we c ea e, au oma ically de elop and
e alua e he se o cons ain s o ha conc e e p o ocol.
Focusing on my pa icula job, o e e y de ined cons ain I will d aw a ee ha
co esponds o i s speci ica ion o, la e on, handily de ine and c ea e a skele on o
ha ee s uc u e in C. Addi ionally, I will implemen all i s espec i e unc ions o
p ope ly wo k wi hin he sys em.
1.3. Documen S uc u e
Fi s o all, I will go h ough all he p e ious backg ound concep s ha need o be
aken in o conside a ion in o de o la e be e unde s and he p ojec i sel . He e I
will alk abou concep s such as p i a e ne wo ks, deep packe inspec ion and
Ne wo k In usion De ec ion Sys ems, as well as some p o ocols ha will be used.
Besides, in his sec ion I will b ie ly desc ibe ou global p ojec amewo k.
Secondly, I will men ion he ne wo k cons ain s ha we ha e come up wi h so a ,
including a deepe explana ion o he cons ain s I ha e pe sonally been wo king on.
The hi d sec ion o he epo con ains he in o ma ion ela ed o he ees’
s uc u es I ha e de eloped o build he cons ain s and e e y hing ela ed o he
implemen a ion o he cons ain s I ha e men ioned be o e. Thus, o each o hose
cons ain s, I will explain he ou -phase mechanism ha is ollowed om he
c ea ion o he dele ion o hei co esponding ees.
In he ou h sec ion i is desc ibed how he cons ain s a e e alua ed wi h my ees
s uc u es’ app oach, di e en ia ing i om my pa ne ’s app oach.
Finally, he Conclusions and Fu u e Wo k sec ion includes he esul s o he
e alua ion o he cons ain s I ha e wo ked on using my app oach, as well as some
ela ed wo k ha could be done in he u u e.

P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
17
2. In oducción
El p ime y i al paso pa a asegu a las edes p i adas consis e en moni o iza
cons an emen e el á ico en ma cha y de ini un “compo amien o no mal” de la ed.
Es e compo amien o pod ía ca ac e iza se po una se ie de es icciones de ed [4], po
lo que una iolación de es as es icciones indica ía una posible in usión. También,
esul a c ucial de ec a es os in usos an p on o como sea posible pa a minimiza el
daño que puedan causa a la ed. Sin emba go, en g andes o ganizaciones en las que se
mandan a la ed miles de paque es po segundo, es a a ea puede no esul a ácil.
2.1. Obje i os
El p opósi o de es e p oyec o de in es igación consis e en p esen a un no edoso
en o no pa a p o ege edes p i adas con un núme o de p o ocolos limi ado an e
a aques de in usiones, a a és de la de ección de aquellos paque es que di ie an del
compo amien o no mal en iempo eal [5]. Pa a ello, modela emos pa ones que
ep esen en el á ico no mal en la ed como es icciones y p esen a emos cómo el
en o no es á e aluando dichas es icciones an e á ico ob enido de una ed
expe imen al usando he amien as PCAP [6]. La Figu a 1 ep esen a a g an escala el
compo amien o global del p oyec o.
Fig. 1. A qui ec u a Global del P oyec o.
Conc e amen e, yo es a é abajando en el Mo o de Res icciones y mi obje i o
consis i á en el diseño, implemen ación y co ec a p ueba del endimien o de es
es icciones an e el á ico de p ueba de nues a ed expe imen al.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
18
2.2. Mé odo
En p ime luga , es amos explo ando el en o no mencionado usando dos p o ocolos:
el P o ocolo de Ges ión de G upos en In e ne (IGMP) [7] y el P o ocolo de
Publicación-Subsc ipción en Tiempo Real (RTPS) [8], es ando es e úl imo basado
en el mecanismo del Se icio de Dis ibución de Da os (DDS) [9]. DDS p opo ciona
un apoyo e icaz y segu idad pa a ipos de se icios c í icos, como pueden se la
ges ión de con ol de á ico aé eo o el come cio inancie o. De ahí que empecemos
a cen a nues a in es igación en es os p o ocolos, ya que pod ían se usados po el
ipo de aplicaciones pa a los que es amos ijando nues o obje i o. Pe o una ez que
nues o p og ama uncione co ec amen e pa a es os dos p o ocolos, nues o
obje i o inal consis i á en cons ui un so wa e capaz de abaja con cualquie
p o ocolo que se le de ina, pe mi iéndole, una ez especi icada la de inición de al
p o ocolo usando un lenguaje que noso os mismos c ea emos, desa olla y e alua
au omá icamen e el conjun o de es icciones pa a dicho p o ocolo en conc e o.
Cen ándonos en mi abajo en pa icula , pa a cada una de las es icciones
de inidas, dibuja é el á bol que co esponda a su especi icación pa a, más a de
de ini y c ea a mano un esquele o pa a esa es uc u a de á bol en C.
Adicionalmen e, implemen a é odas sus espec i as unciones pa a que puedan
in eg a se y unciona co ec amen e den o de nues o sis ema.
2.3. Es uc u a del documen o
P ime o, explica é b e emen e odos los concep os p e ios que necesi an se
comp endidos pa a más a de en ende mejo el p oyec o en sí. Aquí, a a é
concep os ales como edes p i adas, inspección p o unda de paque es y Sis emas de
De ección de In usiones en Redes, así como algunos p o ocolos que se án usados.
Además, en es a sección desc ibi é po encima el en o no global de nues o
p oyec o.
En segundo luga , menciona é las es icciones de ed que hemos encon ado has a
el momen o, incluyendo una mayo explicación de las es icciones sob e las que yo
he es ado abajando pe sonalmen e.
La e ce a sección de la memo ia con iene oda la in o mación elacionada con las
es uc u as de á boles que he desa ollado pa a cons ui las es icciones, y odo
lo elacionado con la implemen ación de dichas es icciones que he mencionado
an e io men e. Así, pa a cada una de esas es icciones, explica é el mecanismo de
cua o- ases que es seguido po ellas desde la c eación has a la eliminación de sus
á boles co espondien es.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
19
En la cua a sección se desc ibe cómo las es icciones son e aluadas con ese
en oque de las es uc u as de á boles, di e enciándolo del en oque que daba mi
compañe o pa a su e aluación.
Finalmen e, la sección de Conclusiones y T abajo Fu u o incluye los esul ados de
la e aluación de las es icciones sob e las que he abajado usando mi en oque, así
como abajo elacionado con el ema que puede se desa ollado en el u u o.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
20
3. Backg ound
Hand ul open sou ce IDS [
10
], such as Sno , Su ica a o B o [
11
], a e cu en ly
a ailable bu , in spi e o p o iding an as ic ea u es and inc edibly la ge ule se s, hey
all ha e a common law: hey only suppo a ew amous p o ocols, like HTTP [
12
] o
TCP [
13
], and i esul s a uly ough ask o add new ules o he da a se . Due o he
ac ha mos o he p i a e ne wo ks use hei own p o ocols buil o speci ic
pu poses, hese In usion De ec ion Sys ems ail o be e ec i e. Tha is why we ocus
ou app oach on de eloping an IDS able o cope and p oduce sa is ac o y esul s wi h
any p o ocol.
3.1. Global P ojec F amewo k
Ou p e iously esea ch g oup’s p oposed amewo k is di ided in o h ee modules:
Scanning, Pa sing and Cons ain Engine [5]. Figu e 2 shows a simpli ied idea o he
in e ac ion be ween hose h ee modules. Basically, he da a low consis s o eading
and pa sing he packe s, and con e ing hem in o da a s uc u es able o be used by
he Cons ain Checke .
Fig. 2. Modules o In usion De ec ion F amewo k.
The scanning module is in cha ge o eading he packe s om PCAP iles using
Wi esha k [
14
] and ex ac ing he essen ial da a. Cu en ly, wo IP p o ocols a e
suppo ed: IGMP and Use Da ag am P o ocol (UDP) [
15
]. Fo e e y single packe ,
he Scanne passes he ollowing in o ma ion o he Pa se : sou ce IP, des ina ion IP
and a i al ime. Besides, i will pass he sou ce and des ina ion po s i he e is a
UDP packe .
The Pa sing module ecei es hese packe s along wi h hei in o ma ion, pa ses
hem and con e s hem in o C da a s uc u es. An ale is gene a ed i he Pa se
ails o pa se any packe . Some examples o ailu es could be mal o med da a, like
non-sensi i e da e o ime alues, o e o s in leng hs, such as a emp ed bu e
o e lows [
16
]. On he con a y, i he packe s a e success ully pa sed, hey a e
passed along o he Cons ain Engine, whe e I am going o ocus my wo k.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
21
The Cons ain Checke is an engine ha implemen s a se e al numbe o
cons ain s ela ed o he de ini ion o he p o ocols. Cu en ly, i is being hand-
w i en by he esea ch g oup, bu i is designed as a empla e o be la e
au oma ically gene a ed om a speci ic language speci ica ion which we a e
wo king on. My mission in he Cons ain Engine is o de elop an app oach o
de ine he ne wo k cons ain s as ee s uc u es [
17
] and, la e on, in eg a e my code
wi h he Pa se module and e alua e hose ees agains sample RTPS da a gene a ed
by ou expe imen al ne wo k. Conc e ely, I should be able o es my app oach o
h ee cons ain s.
Ou ini ial Pa se , inhe i ed om p e ious pene a ion es ing esea ch [
18
], used a
gene al engine ha is pa ame e ized by a g amma g aph. This g aph is gene a ed
om a Syn ax Cons ain Language (SCL) p o ocol desc ip ion [
19
]. SCL de i es
om ASN.1 [
20
], which con ains XML ma kup [
21
] o p o ide bo h con ex
sensi i e pa sing and gene al cons ain s. Ou g amma s o IGMP and RTPS we e
alida ed agains mul iple sou ces o ne wo k da a o ensu e ha he g amma was
co ec . Howe e , he Pa se u ned ou o be oo slow o ou in usion de ec ion
p o o ype when e alua ed agains packe da a om an indus ial pa ne .
Consequen ly, we decided o de elop a new Pa se , which is a hand w i en,
designed wi h he in en ion o being au oma ically gene a ed in he u u e. Thus, we
ha e manually ollowed a igo ous app oach o ansla e he SCL o p oduce a hand
coded pa se .
3.2. P i a e Ne wo ks
In ne wo ks such as ou home In e ne o a ca e’s Wi-Fi we can download apps,
send emails, play games, use Facebook o wa ch YouTube ideos. To sum up, he e
isn’ any es ic ion abou he p o ocols used o he ype o packe s sen h ough he
ne wo k. No e en abou he ype o numbe o de ices connec ed o i .
Consequen ly, i esul s a eally ough wo k o moni o he ongoing a ic o
de e mine wha is “no mal” in hose ne wo ks. These a e called public o
con en ional ne wo ks.
On he o he hand, p i a e ne wo ks o in ane s a e ne wo ks c ea ed by a single
o ganiza ion ha con ols i s secu i y policies and ne wo k managemen . This means
ha he de ices connec ed o hem a e clea ly iden i ied, and ha he packe s ha
hey send belong o a ce ain ype o allowed packe s. They use a limi ed numbe o
p o ocols. Examples o hese ne wo ks a e elecommunica ion, nuclea and powe
plan s, o ai c a con ol sys ems, which ep esen c i ical in as uc u es.
P i a e ne wo ks inc ease hei secu i y by p e en ing ex e nal access, p o ec ing
hei indus ial con ol ope a ion om ou side a acks. Howe e , a p i a e ne wo k is

P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
22
no ully secu ed, as malwa e could be injec ed by USB d i es o ins alla ion discs.
Fo ins ance, he wo ldwide known case o he S uxne wo m used o a ack a
nuclea plan in Na anz was dis ibu ed by an USB lash d i e [
22
]. As a esul , e en
mo e p o ec ion needs o be de eloped. Pe ime e checking, such as i ewalls and
au hen ica ion policies [
23
], a e use ul de ensi e echniques, bu hey can’ moni o
he ongoing a ic. The only way o pe o ming ha du y is using an In usion
De ec ion Sys em [
24
].
3.3. Ne wo k In usion De ec ion Sys ems
Ne wo k In usion De ec ion Sys ems (NIDS) a e he mos e icien way o
de ending agains ne wo k-based a acks. They consis in a de ice o so wa e
applica ion ha moni o s a ne wo k o malicious ac i i y o policy iola ions. NIDS
a e placed a s a egic poin o poin s o he o ganiza ion and pe o ms an analysis o
passing a ic on he en i e subne . These sys ems a e widely used among la ge-
scale IT in as uc u es [
25
]. Basically, he e a e wo main ypes o NIDS: signa u e-
based (SBS) and anomaly-based (ABS).
On he one hand, signa u e-based IDS e e s o he de ec ion o a acks by looking
o speci ic pa e ns, such as by e sequences in ne wo k a ic, o known malicious
ins uc ion sequences used by malwa e. They main ain a da abase o signa u es o
p e iously known a acks and compa e hem wi h he analyzed da a. Thus, an ala m
would be aised when he signa u es we e ma ched. The main ad an age o his
echnique is ha signa u es a e e y easy o de elop and unde s and i we know
wha ne wo k beha io we a e ying o iden i y. Mo eo e , pa e n ma ching can be
done mo e e icien ly as hey can pe o m his ma ching wi h jus a small ule se .
Fo ins ance, i he sys em ha is o be p o ec ed only communica es ia DNS [
26
]
and ICMP [
27
], all o he signa u es can be igno ed. Howe e , SBS only de ec
a acks whose signa u es a e p e iously s o ed in he da abase, so ze o-day a acks
[
28
] canno be de ec ed.
On he o he hand, anomaly-based IDS we e p ima ily c ea ed o de ec unknown
a acks, due o he as de elopmen o malwa e [
29
]. In con as o SBS, hey build
a s a is ical model desc ibing he no mal ne wo k a ic and, and any abno mal
beha io ha de ia es om he model is iden i ied. As anomaly based de ec ion is
based on de ining he ne wo k beha io , i equi es a aining phase o de elop he
da abase o gene al a acks and a ca e ul se ing o h eshold le el o de ec ion. This
accep ed ne wo k beha io is p epa ed o lea ned by he speci ica ions o he
ne wo k adminis a o s. The majo d awback o ABS is de ining i s ule se . As a
consequence, he e iciency o he sys em depends on how well i is implemen ed
and es ed on all p o ocols. Hence, we in oduce he concep o cons ain s in ou
sys em because i ep esen s mo e concise ac ions han ules [
30
]. Fu he mo e, e en
using dynamic ules o exis ing IDS, i esul s a eally ough ask o c ea e a lexible
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
23
and exp essi e ule se which can ep esen a eal complex a ack scena io [5]. The
majo ad an age o e SBS is ha a no el a ack o which a signa u e does no exis
can be de ec ed i i alls ou o he no mal a ic pa e ns.
3.4. Deep Packe Inspec ion
The e is a la ge numbe o o ganiza ions p o ec ing hei ne wo ks wi h i ewalls,
simply limi ing hei a ic h ough he po s 22, 80 and 443, co esponding wi h he
SSH [
31
], HTTP [9] and HTTPS [
32
] p o ocols espec i ely. Any packe
ansmi ed by a p o ocol which does no co espond o any o hese h ee ones, is
au oma ically disca ded. Howe e , a acke s ha e ound he way o in uding hose
ne wo ks hiding hei unc ionali y unde ei he he SSH, HTTP o HTTPS p o ocols
[
33
]. As a esul , hey a e able o snick in o he ne wo k’s allowed a ic wi hou
being no iced and co espondingly ejec ed by he i ewalls.
Because o hese a acke s, a simply i ewall is no enough o p o ec he ne wo ks,
and mo e sophis ica ed echniques need o be de eloped. He e come o scene he
e m ‘Deep Packe Inspec ion’. DPI is an ad anced me hod o packe il e ing ha
unc ions a he Applica ion laye o he OSI (Open Sys ems In e connec ion)
e e ence model [
34
]. “The use o DPI makes i possible o ind, iden i y, classi y,
e ou e o block packe s wi h speci ic da a o code payloads ha con en ional
packe il e ing, such as i ewalls, which examines only packe heade s, canno
de ec ” [
35
]. By looking deeply in o he packe ields, i is possible o iden i y he
eal da a ha is being sen in each packe . This makes i e ec i e agains bu e
o e low a acks, denial o se ice (DoS) a acks and ce ain ypes o malwa e.
3.5. Da a Dis ibu ion Se ice
The Da a Dis ibu ion Se ice (DDS) is an Objec Managemen G oup (OMG)
p o ocol whose goal is o p o ide eliable eal- ime and scalable communica ions a
a high pe o mance by using a publish-subsc ibe mechanism. Ai a ic con ol,
inancial ading o o he big da a applica ions a e examples o en i onmen s whe e
a p o ocol like DDS is needed o hei pu poses. Besides, his s anda d is widely
used among wo ldwide ecognized ins i u ions such as he NASA [
36
] o he
Canadian Ai T a ic Con ol Sys em [
37
], as well as in he mining indus y o check
mining equipmen and in he au omobile sec o o de elop simula o s [
38
].
As shown in Figu e 3, DDS p o ides an in as uc u e laye ha enables many
di e en ypes o applica ions o communica e wi h each o he .
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
24
Fig. 3. DDS In as uc u e.
Pa do-Cas ello e’s pape says: “Publish-subsc ibe applica ions a e ypically
dis ibu ed applica ions wi h endpoin nodes ha communica e wi h each o he by
sending (o publishing) da a and ecei ing (o subsc ibing) da a anonymously.
Usually he only p ope y ha a publishe needs in o de o communica e wi h a
subsc ibe is he opic name and he de ini ion o he da a. Wha is mo e, he
publishe does no need any in o ma ion abou he subsc ibe s and ice e sa”.
Resul an ly, he only needed hing o lis en o ce ain da a is he Topic Key o he
da a published and he Domain Id.
As said in he RTI pape , “A publish-subsc ibe in as uc u e is capable o
deli e ing da a o he app op ia e nodes wi hou ha ing o se up indi idual
connec ions be ween hem”. Machines in e es ed in ecei ing packe s ela ed o a
ce ain opic jus need o become a subsc ibe o ha opic. Analogously, nodes
willing o send da a abou a ce ain opic jus need o become a publishe o ha
opic, and he DDS in as uc u e will au oma ically assu e ha he published
in o ma ion is dis ibu ed o all subsc ibe s in e es ed in ha opic, wi hou he
publishe needing o speci y hose des ina ion po s.
The speci ica ion o DDS is b oken up in o wo sepa a e laye s: Da a-Cen ic
Publish-Subsc ibe (DCPS) and Da a Local Recons uc ion Laye (DLRL) [13]. Fo
ou pu pose, we will only concen a e on he DCPS po ion o he speci ica ion.
RTI’s pape de ines DCPS as ollowing: “DCPS is he lowe laye API ha an
applica ion can use o communica e wi h o he DDS-enabled applica ions”. This
communica ion mechanism p o ides hem he abili y o speci y se e al Quali y o
Se ice (QoS) pa ame e s, such as a e o publica ion, a e o subsc ip ion o how
long da a is alid o . These pa ame e s allow he sys em designe s o build a
cus omized dis ibu ed applica ion based on hei equi emen s. In DCPS,
applica ions mus use APIs o c ea e en i ies (objec s) in o de o es ablish publish-
subsc ibe communica ions be ween each o he . DCPS has he ollowing p ima y
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
25
en i ies: Domain, Domain Pa icipan , Da a W i e , Publishe , Da a Reade ,
Subsc ibe and Topic. Figu e 4 shows how en i ies in DDS a e ela ed.
Fig. 4. DDS En i ies.
The Domain is he basic elemen needed o bind indi idual applica ions and s a a
communica ion be ween hem. DDS has he capabili y o suppo ing bo h a single
Domain o applica ion’s da a-cen ic [13] communica ions, and mul iple Domains.
I he sys em is using a single Domain, all he nodes will communica e wi hin his
Domain. On he con a y, i we ha e a sys em ha can scale wi h e ec i e da a
isola ion, we migh choose mul iple Domains. The e o e, when speci ic da a is
published in one Domain, i will no be ecei ed by Subsc ibe s esiding on any
o he Domains. Mo eo e , mul iple Domains a e also a g ea way o con ol he
in oduc ion o a new unc ionali y in o an exis ing sys em.
An applica ion uses a Domain Pa icipan o ep esen i s ac i i y wi hin a Domain.
This allows de elope s o de ine de aul QoS pa ame e s o all Da a W i e s,
Publishe s, Da a Reade s and Subsc ibe s in ha Domain. Thus, his makes i easy
o speci y de aul beha io in he Domain.
Ob ained om Pa do-Cas ello e’s pape , “Da a W i e s a e he p ima y access poin
o an applica ion o publish da a in o a DDS domain”. An applica ion uses Da a
W i e s o send da a. These a e associa ed wi h a single Topic. An applica ion can
ha e mul iple Da a W i e s and Topics. Besides, i can ha e mo e han one Da a
W i e o a pa icula Topic. Howe e , be o e being able o pe o m a w i e call,
Da a W i e s need o be c ea ed and con igu ed wi h he co ec QoS se ings.
The Publishe is jus a con aine o g oup and manage oge he indi idual Da a
W i e s. I ep esen s he DCPS objec esponsible o he ac ual sending o da a.
Whe eas a Da a W i e can only be owned by a single Publishe a Publishe can own
mul iple Da a W i e s [
39
]. Hence, he same Publishe may be sending da a o
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
32
As we al eady know, a Topic is he link ha connec s Publishe s and Subsc ibe s.
Re e ing o he DDS manual, i is pe ec ly possible ha a Pa icipan can become a
Publishe and a Subsc ibe o he same Topic a he same ime. Hence, a Pa icipan can
lis en o da a on a ce ain Domain, al e his da a and, e en ually, o wa d i o he
mul icas g oup. This ac can lead o wo possible a acks: a malicious Publishe
sending illegi ima e da a; o a denial o se ice caused by inc easing he ne wo k’s
a ic.
Acco dingly, Cons ain 7 p e en s hese scena ios by making su e ha a cu en
Publishe o a ce ain Topic in a Domain does no become a Subsc ibe o he same
Topic in ha Domain, and ice e sa.
C8. RTPS – Subsc ibe u ning Publishe : A Topic Key can only be published om a
speci ic se o hos s.
RTPS is used in Ai T a ic Con ol (ATC) [
44
] wo ldwide o p o ide secu e ai a ic
managemen and communica ions. Fo ins ance, he e mus be jus a speci ic se o
ada in o ma ion publishe s, o a speci ic machine which allows a plane o land. In
ATC, his means e y sensible in o ma ion ha mus be ca e ully aken ca e o o
p o ide a sa e and e icien mo emen o ai c a s in he ai space.
Cons ain 8 e e s o de ining a se o Publishe s esponsible o sending a es ic ed
ype o in o ma ion. The e o e, any machine publishing es ic ed in o ma ion ha does
no belong o he se o allowed Publishe s o ha Topic cons i u es an in usion.
C11. RTPS – Validi y o communica ion: Only a alid Publishe and a alid
Subsc ibe can communica e.
Du ing an RTPS unicas communica ion, DATA packe s a e cons an ly being sen om
Publishe s o Subsc ibe s. In ou p e ious cons ain s we we e checking ha ei he he
Pa icipan s we e membe s o a alid mul icas g oup o ha Publishe s we e legi ima e.
Now, we a e aking in o conside a ion ha when a Publishe sends a DATA packe , i s
des ina ion is a alid Subsc ibe .
Fo his ype o cons ain s, i is no enough o check he alidi y o he Publishe , as an
au ho ize hos could be publishing “legi ima e” in o ma ion o in ude s. Hence we mus
check ha e e y DATA packe sen in ou ne wo k is coming om a us able Publishe
and eaching an allowed Subsc ibe .

P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
33
5. Implemen a ion
Once he packe s a e scanned and success ully pa sed by he p e ious p ojec ’s modules
(Figu e 1), hey a e passed o he Cons ain Engine. Acco ding o i s p o ocol, i al eady
ecei es he necessa y pa ame e s o each packe o deal wi h he cons ain s. I s basic
unc ion is o e alua e he da a s uc u es ecei ed by he Pa se and p omp an ale
when a cons ain is iola ed. Figu e 6 shows a simpli ied amewo k o cons ain
based IDS.
Fig. 6. IDS F amewo k.
As he p ojec is coded in C and, unlike C++, he e was no any ee o Di ec ed Acyclic
G aph (DAG) [
45
] s uc u e a ailable o use, my i s app oach was o de elop ou own
ee class and ee s uc u e mysel , as well as all i s unc ionali y. Mo eo e , he ees
we e no always bina y ees [
46
], and he numbe o child en o each node could a y
depending on he cons ain , making i mo e di icul o ep esen ou da a. E e y ime a
packe a i ed, I had o loop h ough he ee o popula e he lea nodes, as well as o
e alua e i (Figu e 7 shows how he cons ain ees look like). Hence, his app oach
esul ed o be O(log n) and, he e o e, conside ably cos ly in ime [
47
].
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
34
Fig. 7. Cons ain ’s ee skele on.
As a esul , I had o de elop a be e app oach. This app oach is s ill using ees o
ep esen and sol e he cons ain s. Howe e , ins ead o c ea ing a ee class, I ha e
coded a new DAG s uc u e (Figu e 8), which ep esen s a cons ain as an a ay o
nodes by jus keeping a poin e o he Roo Node and he leng h o he s uc u e. Wi h
his s uc u e I can uniquely ep esen a gene al skele on o each single cons ain .
Also, e e y ime I need o c ea e a new ins ance o he ee I jus ha e o alloca e some
memo y and do a memcopy() [
48
], wi hou ha ing o walk h ough he ee o copy i .
Fig. 8. Snippe o he DAG s uc u e.
Consequen ly, I ha e also de eloped a node s uc u e (Figu e 9) o be able o ep esen
he di e ences be ween he ope a o and he lea nodes. These di e ences e e o hei
alues and numbe o child en. Each node is composed by a alue, an in ege ha
indica es he posi ion whe e i s child en s a o be alloca ed in he a ay, an in ege
e e ing o i s numbe o child en and a ype o node. Knowing he posi ion and
numbe o child en allows us o build he hie a chy o he ee. The “eType” ield
indica es whe he he node is an Ope a o Node o a Lea node. Depending on he Lea
Node’s ype (in ege o cha ) i s “ Value” ield may a y. Finally, I dis inguish be ween
he a ious ypes o Ope a o Nodes: “andOp”, “o Op”, “eqOp” and “no EqOp”
co espond o hei logical exp essions “&&”, “||”, “==” and “!=”. Whe eas he “ iol”
and “a ” ope a o s only e e o Roo Nodes. The “ iol” ope a o means ha ha ee
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
35
should p omp an ale i i s e alua ion is no sa is ied, while he “a ” ope a o means
ha an ale should be p omp i he ee’s e alua ion is sa is ied.
Fig. 9. Snippe o he Node s uc u e.
Due o his s uc u e, I am able o know he exac posi ion o e e y node in he a ay o
each cons ain , making e e y ope a ion made on a node O(1), accessing di ec ly o he
posi ion wi hou ha ing o loop h ough he ee. This will be easie o unde s and i we
ake a look o Figu e 10 (Cons ain 1 ee). The eby, he ou cons ain s’ ees I ha e
de eloped and hei co esponding snippe s o code using his ee s uc u e a e as
ollow:
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
36
Fig. 10. T ee d awing o Cons ain 1.
Fig. 11. DAG s uc u e o Cons ain 1.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
37
Fig. 12. T ee d awing o Cons ain 5.
Fig. 13. DAG s uc u e o Cons ain 5.
Fig. 14. T ee d awing o Cons ain 7.

P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
38
Fig. 15. DAG s uc u e o Cons ain 7.
Fig. 16. T ee d awing o Cons ain 8.
Fig. 17. DAG s uc u e o Cons ain 8.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
39
Fig. 18. T ee d awing o Cons ain 11.
Fig. 19. DAG s uc u e o Cons ain 11.
Addi ionally, I ha e c ea ed a Hash Table [
49
] s uc u e o each ype o cons ain o
keep ack o he exis ing ees ali e. E e y Hash Table is o med by a key and a alue.
In my app oach, I ha e c ea ed a “hashnode” s uc u e whe e he key o each Hash
Table is composed o he pa ame e s ha c ea e ha cons ain and iden i y a single
ins ance o he cons ain , and he alue is a poin e o he posi ion whe e he T ee Roo
o ha cons ain is alloca ed. As a esul , my Hash Table is an a ay o “hashnodes”.
The eby, his Hash Table allows me o easily ind ou whe he a ee exis s o no and, i
i al eady exis s, modi y o dele e i . Figu e 20 shows how his s uc u e looks like o
Cons ain 1. Simila ly, i wo ks o he o he h ee cons ain s.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
40
Fig.20. Snippe o he Hash Table s uc u e o Cons ain 1.
Thanks o my pa ne ’s p e ious esea ch, we ha e come up wi h a ou -phase-
p ocedu e o sol e he cons ain s. The eby, when a new packe a i es and ma ches any
o ou cons ain s, i is classi ied o i s co esponding phase. These ou phases a e
Ins an ia e, Bind, E alua e and Dele e.
1. Ins an ia e: e e y cons ain has an ac ion ha igge s he c ea ion o a new
ee and, consequen ly, makes us ake in o conside a ion di e en aspec s o he
machine causing i and ollow up i s beha io . This ac ion is o en ela ed o a
speci ic ype o message. Thus, he Ins an ia e phase e e s o he c ea ion o a
new ee skele on and popula ion o he i s lea nodes wi h he co esponding
alues o a packe ha is sending a “ igge message” ha ma ches any o ou
cons ain s. Besides, i is unde s ood ha such ee should no p e iously exis .
2. Bind: he e a e single packe cons ain s (al eady managed by he Pa se ) and
mul iple packe cons ain s. Wi hin mul iple packe cons ain s we can
dis inguish be ween wo-packe cons ain s and mo e- han- wo-packe
cons ain s. The eason why we make his dis inc ion is because o he Bind
phase. This phase akes place when he a i ing message co esponds o an
expec ed message o ill in he emaining lea es om a p e iously c ea ed ee
in he Ins an ia e phase. Howe e , he cons ain ’s ee is no eady o be
e alua ed ye , because is s ill wai ing o mo e packe s. Hence, exclusi ely
mo e- han- wo-packe cons ain s con ain his Bind phase. On he con a y, wo-
packe cons ain s would go di ec ly o e alua ion when one o hose messages
a i es.
In addi ion, usually jus aking a look a he d awing ees i is easy o know i
ha cons ain has a Bind phase o no . So, i he numbe o child en o he las
le el Ope a o Nodes is g ea e han wo, i means ha he ee has a Bind phase.
Al hough some imes i migh need he Bind phase e en i i he numbe is wo.
3. E alua e: simila ly o he Bind phase, when an expec ed packe ma ching an
Ins an ia ion ee a i es, i s emaining lea es a e popula ed. The di e ence wi h
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
41
he Bind phase is ha he cons ain does no ha e o wai o mo e packe s o be
e alua ed. As a esul , when his phase akes place, he ee is eady o
e alua ion. Fu he mo e, i will p omp an ale i he e alua ion esul s o be a
iola ion o he cons ain .
4. Dele e: al hough we migh hink ha e e y ee is being dele ed a e i s
e alua ion, his assump ion is no always alid. I could be possible ha a ee is
dele ed igh a e being e alua ed, bu ha does no usually happen. No mally,
he ees a e kep ali e un il a speci ic message o ac ion says he con a y ( his
concep will be e be unde s ood when we will go h ough each single
cons ain ’s case). When ha happens, we will bo h ee he memo y o he ee
i sel and i s e e ence in he Hash Map.
Acco ding o his ou -phase p ocedu e, he i e cons ain s I ha e been wo king on
we e de eloped as desc ibed below:
5.1. CONSTRAINT 1: A hos is only allowed o send wo successi e Join Repo s o a
speci ic g oup.
Jus a eminde ha a Join Repo e e s o a Membe ship Repo sen by a hos wi hou
p e iously ha ing ecei ed a Membe ship Que y om he ou e . This cons ain was
caused by he ac ha a hos migh wan o join a mul icas g oup wi hou ha e been
que ied by he ou e esponsible o ha g oup.
Ins an ia e: his phase akes place when a hos sends an IGMP 2 o IGMP 3 Repo o
a mul icas g oup add ess and such add ess does no ma ch o a p e ious Membe ship
Que y made om ha add ess. Resul an ly, i i did no exis ye in he Cons ain 1
Hash Table (which would mean ha he Join Repo is no he i s one sen by ha hos
and i s ee has al eady been ins an ia ed), we c ea e a new Cons ain 1 ee and we
popula e i s i s lea nodes. Besides, we inse i in he co esponden Hash Table.
Figu e 21 ep esen s he pa o he code co esponding o Cons ain 1’s ins an ia ion
and Figu e 22 shows how he ee would look like a he end o his phase.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
48
Ins an ia e: we ins an ia e a C7a’s ee e e y ime a Da a(w) packe (which co esponds
o a Publishe ) a i es and i does no ma ch o a co esponding ins an ia ion ee c ea ed
by he same hos sending a Subsc ibe packe . Analogously, we ins an ia e a C7b’s ee
e e y ime a Da a( ) packe (which co esponds o a Subsc ibe ) a i es and i does no
ma ch o any p e iously ins an ia ed ee c ea ed by he same hos sending a Publishe
packe . In any case, we ha e o inse hem in hei espec i e Hash Table. Howe e ,
hei d awing ees look exac ly he same. Figu e 32 shows how bo h C7a’s ee and
C7b’s ee look like a e ins an ia ion.
Fig. 32: T ee d awing a e Ins an ia e phase o Cons ain 7.
E alua e: simila ly o how we ha e ins an ia ed he ees wo ks he E alua e phase.
This is also igge ed by a Publishe o a Subsc ibe packe . On he one hand, we
e alua e C7a when a new Publishe packe a i es and i al eady exis s i s co esponden
C7b’s ins an ia ion ee. On he o he hand, we will send C7b o e alua ion i a
Publishe packe a i es and ma ches o i s co esponden C7a’s ins an ia ion ee.
Figu e 33 illus a e he e alua ion ees o bo h C7a and C7b.

P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
49
Fig. 33: T ee d awing a e E alua e phase o Cons ain 7.
Dele e: when a hos sends a Lea e Repo and i ma ches o a p e iously c ea ed
Cons ain 7’s ee we will bo h dele e he espec i e ee and i s e e ence in he Hash
Table.
5.4. CONSTRAINT 8: A Topic Key can only be published om a speci ic se o hos s.
Fo e e y Topic he e is a lis o legi ima e Publishe s, which a e he only ones allowed
o push da a abou ha Topic. As a esul , Cons ain 8 jus needs o check i a Da a(w)
message comes om one o hose legi ima e hos s. I migh seem ha his is a single
packe cons ain and, consequen ly, i should be e alua ed by he Pa se . Howe e , he e
is whe e we in oduce he concep o “Lea ning Mode” [52]. E e y o he cons ain I
ha e men ioned be o e is pa o he “Checking Mode”, bu ou Cons ain Engine also
possesses a “Lea ning Mode” which has been de eloped by my pa ne . This “Lea ning
Mode” allows ou Cons ain Engine o, as i s own name implies, o lea n om “ ac s”
[52] and include hem o ou engine. The e o e, when we ha e a new Publishe packe
we will include i o ou “ ac s”, le ing us know in he u u e ha such hos is a alid
Publishe . Hence, ou Cons ain Engine is able o upda e i sel and lea n om hose
upda es, dealing wi h cons ain s ha , as happens wi h Cons ain 8, migh appea o be
single packe cons ain s and, as a consequence, alida ed by he Pa se . Thus, as i does
no in ol e mo e han wo packe s o be e alua ed, his cons ain only has h ee ou o
ou ou phases.
Ins an ia e: whene e we a e in “Lea ning Mode” and we ecei e a message om a
hos wan ing o become pa o he Domain Pa icipan , we will ins an ia e a new
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
50
Cons ain 8’s ee. Like his, we will also inse i in i s espec i e Hash Table. Figu e
34 ep esen s Cons ain 8’s ee a e ins an ia ion.
Fig. 34: T ee d awing a e Ins an ia e phase o Cons ain 8.
E alua e: a e ha ing ins an ia ed ou ee o Cons ain 8, he ollowing incoming
Publishe packe s om ha hos in ha Domain will be sen o e alua ion, wi hou
going h ough a Bind phase. Also, no ice ha , as happened wi h Cons ain 5, we migh
ha e o e alua e Cons ain 8 wi hou ha ing p e iously ins an ia ed i s ee. In o he
wo ds, we ha e o check i e e y Publishe is us able, esul ing his in a iola ion o
Cons ain 8 i ha Publishe did no belong o a p e ious ins an ia ed ee. Figu e 35
shows he s a e o Cons ain 8’s ee a e e alua ion.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
51
Fig. 35: T ee d awing a e E alua e phase o Cons ain 8.
Dele e: as i happens wi h mos o he cons ain s, he Dele e phase akes place when
ha speci ic hos sends a Lea e Repo o he mul icas g oup. Consequen ly, we ha e
o upda e ou “ ac s” his ime apa om emo ing he ee and i s e e ence in he Hash
Table.
5.5. CONSTRAINT 11: Only a alid Publishe and a alid Subsc ibe can communica e.
Ins an ia e: he packe ha igge s he ins an ia ion o Cons ain 11 is a Da a(w)
packe sen by a hos ha is no i ying he ou e ha wan s o become a new Publishe .
As a consequence, when his ype o packe a i es we will s o e in he ee he packe ’s
espec i e IP and en i y key o, la e on, inse i in he co esponden Hash Table. This
will mean ha he hos is a alida ed Publishe . Also, he sea ch keys o ind ha ee in
he Hash Table will be he Topic Key and he Publishe IP, so hose a e he alues we
will ha e o look o in he Bind phase. Figu e 36 shows he s a e o he Cons ain 11
ee a e being ins an ia ed.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
52
Fig. 36: T ee d awing a e Ins an ia e phase o Cons ain 11.
Bind: he Bind phase akes place when a Da a( ) packe om a Subsc ibe a i es. As
men ioned be o e we will ha e o look o he Topic Key and he Publishe IP ha ha
Subsc ibe is willing o lis en o. Depending on he esul o ha sea ch we will ha e
wo di e en op ions: i we canno ind he ee i would be an e o , o i , on he
con a y i does, we would ha e o go o an in e media e phase called “Spli ” [52]. This
consis s on making an exac copy o he ins an ia ion ee, popula e he new alues and
upda e he new sea ch keys, because he e alua ion packe o Cons ain 11 will be
looking o he Publishe IP, Publishe po and Subsc ibe IP ins ead o he Topic Key
and Publishe IP. Consequen ly, we will also dele e he p e ious ins an ia ion ee.
Figu e 37 helps isualizing he s a e o he ee a e his phase.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
53
Fig. 37: T ee d awing a e Bind phase o Cons ain 11.
E alua e: when a DATA packe is sen om a Publishe o a Subsc ibe Cons ain 11
will go o e alua ion. Thus, we will sea ch o he Bind phase’s keys and s o e he
emaining Lea nodes. I a e inishing popula ing he ee all i s nodes a e alida ed,
we can assu e ha he DATA was communica ed om a legi ima e Publishe o an
au ho ized Subsc ibe . We can isually see ep esen ed he Cons ain 11 ee a e he
e alua ion phase akes place in Figu e 38.
Fig. 38: T ee d awing a e E alua e phase o Cons ain 11.

P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
54
Dele e: he co esponding ee o Cons ain 11 will be des oyed when any o he
espec i e pa icipan s lea e he mul icas g oup. Resul an ly, ha ee will also be
emo ed om he Hash Table.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
55
6. E alua ion
Assuming ha all he ees co esponding o a same cons ain look alike could mean
ha keeping he ull ee s uc u e is no longe needed. In o he wo ds, i we know ha ,
o example, he hi d node o he Cons ain 7’s ee is always an “EQUAL” node, why
do we ha e o loop h ough i and check ha node’s alue e e y ime we e alua e
Cons ain 7? Besides, why do we ha e o keep all he Ope a o Nodes o e e y
ins ance o a cons ain ’s ee i we al eady know wha hei alues a e always going o
be? I should only be necessa y o sa e he lea es’ alues o e alua e he cons ain .
In ac , ha is Siam’s app oach: o assume ha he Ope a o Nodes o a ce ain
cons ain ne e change, so we do no ha e o keep hem and sa e memo y o hem
e e y ime we c ea e a new ee o ha cons ain . In addi ion, he is e alua ing he ees
by simply compa ing he lea alues wi h he ope a o s ha “we assume do no a y”,
wi hou looping h ough all he ee s uc u e. Howe e , we a e no comple ely su e
abou ha assump ion.
Thus, he pu pose o his esea ch is o compa e he esul s o my e alua ion o Siam’s,
es ing ou Cons ain Engine agains sample gene a ed a ic da a. As a esul , i he
assump ion ha we a e making is e en ually ue, we could es whe he ge ing id o
he Ope a o Nodes and a oid walking h ough he ees is ime cos ly signi ican .
The e o e, ocusing in my app oach, i consis s on keeping a copy o he ull ee
s uc u e e e y ime we c ea e a new ins ance o ha ee and walking h ough e e y
node o he ee when i is sen o e alua ion wi hou ob ia ing whe he he Ope a o
nodes a e always he same. So, in o de o e alua e he ees using my app oach I
c ea ed a s uc u e ha beha es simila ly o a s ack, shown in Figu e 39. I s basic
unc ioning consis s in pushing he Ope a o nodes o he s ack un il we ind an
Ope a o node whose child en a e Lea nodes. In ha case, we will e alua e i s child en
and upda e he Ope a o node’s alue wi h ha esul . Following, we will s a going
backwa ds in he s ack e alua ing he Ope a o nodes o he highe le els wi h he
esul s ob ained in he p e ious lowe le els o he ee.
Fig. 39: Snippe o he auxilia y s ack s uc u e.
In o de o make he e alua ion unc ion easie , I ha e de eloped h ee auxilia y
unc ions, which we can app ecia e in Figu es 40, 41 and 42. The i s o hem simply
checks whe he a ce ain node’s child en a e Lea nodes. Thanks o ha unc ion, I can
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
56
easily iden i y which nodes belong o he las Ope a o nodes le el and s op pushing he
ollowing nodes o he s ack. Secondly, he Compa eValues() unc ion ecei es wo
nodes and an logic ope a o as pa ame e s, and e u ns he esul o e alua ing hose wo
node’s alues agains ha pa ame e . This unc ion esul s qui e help ul o simpli y he
compa ison be ween he Lea nodes di e en ia ing be ween he se e al ypes o logic
ope a o s. Finally, he ge Resul s() me hod uses he p e ious unc ion o ga he he
esul o compa ing he alues o all o a ce ain node’s child en acco ding o ha
node’s ope a o , so I can compa e mo e han wo Lea nodes and ob ain a single esul
ha will be used by he highe le el Ope a o nodes o con inue e alua ing he ee.
Fig. 40: Snippe o he auxilia y unc ion HasLea Node().
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
57
Fig. 41: Snippe o he auxilia y unc ion Compa eValues().
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
64

P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
65
9. Appendix
9.1. Use Manual
IMPORTANT: a Linux ope a i e sys em is needed o un he p og am.
9.1.1. Lea ning Mode
Go o he IDS/pa se Gene a o /F_Cons ain s olde and open he
Cons ain s.c ile wi h a ex edi o . Commen ou (o make su e ha i is
commen ed ou ) he “#de ine LEARN” line. Sa e he ile.
Fig. 44: Snippe o code o Lea ning Mode.
Open a new e minal and mo e o he IDS/pa se Gene a o /F_Cons ain s
di ec o y. Compile and link he p og am using make. I is possible han
make has no hing o be done a all.
Fig. 45: Using make command.
Run he p og am using he ollowing command:
./pcappa se LongS essTes .pcapng
Once you ha e un i , he p og am will ha e “lea ned” om ou Fac s
iles and will be eady o execu ion. I is possible ha some o he
cons ain s ha do no need o lea n om ac s o hei e alua ion we e
e alua ed. You should ge some hing like his:
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
66
Fig. 46: Running he p og am in Lea ning Mode.
9.1.2. Checking Mode
Go o he IDS/pa se Gene a o /F_Cons ain s olde and open he
Cons ain s.c ile wi h a ex edi o . Commen (o make su e ha i is
commen ed) he “#de ine LEARN” line. Sa e he ile.
Fig. 47: Snippe o code o Checking Mode.
Open a new e minal and mo e o he IDS/pa se Gene a o /F_Cons ain s
di ec o y. Compile and link he p og am using make. I is possible han
make has no hing o be done a all.
Fig. 45: Using make command.
Run he p og am using one o he wo ollowing op ions:
1. ./pcappa se LongS essTes .pcapng. This op ion is hough o
pe o mance es ing, so we do no speci y any ace ile whe e o w i e
he ou pu s.
Fig. 48: Running command o 2 a gumen s.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
67
2. ./pcappa se LongS essTes .pcapng pa se ace [ aceFileName].
This op ion, apa om showing he esul s o he execu ion in he
e minal, i also w i es he ou pu s o a ace ile. Once he p og am
has inished unning, you can check he ou pu s opening he aceFile
ile which has been c ea ed in he same di ec o y.
Fig. 49: Running command o 4 a gumen s.
In any case, you should ge he same esul s p in ed ou in he e minal,
which should be simila o hese:
Fig. 50: Running he p og am in Checking Mode.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
68
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
69
Re e ences
[
1
] And eea Bendo schi . “Cybe -A acks – T ends, Pa e ns and Secu i y
Coun e measu es”, 2015 (7 h In e na ional Con e ence on Financial C iminology 2015,
Wadham College, Ox o d, UK).
[
2
] Qijun Gu, Peng Liu. “Denial o Se ice A acks”, 2007.
[
3
] Biswana h Mukhe jee, L. Todd Hebe lein, Ka l N. Le i . “Ne wo k In usion
De ec ion”, 1994 (IEEE Ne wo k).
[
4
] Ped o Salguei o and Sal ado Ab eu. “Modeling Dis ibu ed Ne wo k A acks wi h
Cons ain s”, 2011.
[
5
] Siam Hasan, A. ElShakanki y, T. Dean and M. Zulke nine. “De ec ion o In usion
in P i a e Ne wo k by Sa is ying Ne wo k Cons ain s”, 2016.
[
6
] S ephen Deck and Hamed Khiabani. “Ex ac ing Files om Ne wo k Packe
Cap u es”, 2015.
[
7
] B. Fenne , H. Be, B. Habe man and H. Sandick. “In e ne G oup Managemen
P o ocol (IGMP) Mul icas Lis ene Disco e y (MLD)-Based Mul icas Fo wa ding
(IGMP/MLD P oxying)”, 2006. (h ps:// ools.ie .o g/h ml/ c4605)
[
8
] Ge a do Pa do-Cas ello e. “OMG Da a Dis ibu ion Se ice: Real-Time
Publish/Subsc ibe Becomes a S anda d”, 2005.
[
9
] G. Pa do-Cas ello e, B. Fa abaugh and R. Wa en. “An In oduc ion o DDS and
Da a-Cen ic Communica ions”, 2005.
[
10
] O. Eldow, P. Chauhan, P.Lalwani and M. B. Po da . “Compu e Ne wo k Secu i y
IDS Tools and Techniques (Sno /Su ica a).
[
11
] V. Paxson. “B o: A Sys em o De ec ing Ne wo k In ude s in Real- ime”, 1999.
[
12
] R. Fielding, J. Ge ys, J. Mogul, H. F ys yk, L. Masin e , P. Leach and T. Be ne s-
Lee. “Hype ex T ans e P o ocol—HTTP/1.1”, 1999.
(h ps:// ools.ie .o g/h ml/ c2616)
[
13
] “RFC 793: T ansmission Con ol P o ocol.” (h ps://www.ie .o g/ c/ c793. x )
[
14
] “Wi esha k.”
(h ps://www.wi esha k.o g/docs/wsug_h ml_chunked/Chap e In oduc ion.h ml)
[
15
] J. Pos el. “RFC 768 - Use Da ag am P o ocol”, 1980
(h ps:// ools.ie .o g/h ml/ c768)

P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
70
[
16
] C. Cowan, P. Wagle, C. Pu, S. Bea ie and J. Walpole. “Bu e O e lows: A acks
and De enses o he Vulne abili y o he Decade”.
[
17
] “The T ee Da a Model” – S an o d Uni e si y
(h p://in olab.s an o d.edu/~ullman/ ocs/ch05.pd ). Re ie ed: Ap il 8 h 2017.
[
18
] S. Ma quis, T. R. Dean and S. Knigh . “Packe Decoding Using Con ex Sensi i e
Pa sing”, in P oceedings o he 16 h IBM Cen e o Ad anced S udies Con e ence
(SCASCON 06), pp. 263–274, 2006.
[
19
] S. Ma quis, T. R. Dean and S. Knigh . “SCL: A Language o Secu i y Tes ing o
Ne wo k Applica ions”, in P oceedings o he 2005 con e ence o he Cen e o
Ad anced S udies on Collabo a i e Resea ch (CASCON 05), pp. 16–19, 2005.
[
20
] “ASN. 1” (h p://www.i u.in /en/ITU-T/asn1/Pages/in oduc ion.aspx) Re ie ed:
Ap il 10 h 2017.
[
21
] “XML 1.0 Speci ica ion”. Wo ld Wide Web Conso ium
(h ps://www.w3.o g/TR/REC-xml/) Re ie ed: Ap il 10 h 2017.
[
22
] R. P. And ew Cla k, Quanyan Zhu and T. Basa au ho . “An Impac awa e De ense
Agains S uxne Ame ican Con ol Con e ence, ACC, Washing on DC, USA”, 2013.
[
23
] A. Buecke , P. And eas and S. Paisley. “Unde s anding he IT Pe ime e Secu i y”,
IBM, 2008.
[
24
] D. E. Denning. “An In usion-De ec ion Model”. IEEE TRANSACTIONS ON
SOFTWARE ENGINEERING, 1987.
[
25
] I an Gul and M. Hussain. “Dis ibu id Cloud In usion De ec ion Model”, 2011.
[
26
] P. Mockape is. “RFC 1035: Domain Names – Implemen a ion and Speci ica ion”,
1987 (h ps://www.ie .o g/ c/ c1035. x )
[
27
] J. Pos el.“RFC 792: In e ne Con ol Message P o ocol”, 1981
(h ps:// ools.ie .o g/h ml/ c792)
[
28
] D. Hamma be g. “The Bes De enses Agains Ze o-day Exploi s o Va ious-sized
O ganiza ions”, 2014.
[
29
] V. Jyo hsna, VV. R. P asad and K. Muni a a P asad. “A e iew o anomaly based
in usión de ec ion sys ems”, 2011.
[
30
] D. Odden. “Rules . Cons ain s”, 2007.
[
31
] T. Ylonen and C. Lon ick. “The Secu e Shell (SSH) P o ocol A chi ec u e”, 2006.
(h ps://www.ie .o g/ c/ c4251. x )
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
71
[
32
] E. Resco la and A. Schi man. “The Secu e Hype ex T ans e P o ocol”, 1999.
(h ps:// ools.ie .o g/h ml/ c2660)
[
33
] B. Wippich. “De ec ing and P e en ing Unau ho ized Ou bound T a ic”, 2007.
[
34
] Rachelle L. Mille . “The OSI Model: An O e iew”, 2001.
[
35
] h p://sea chne wo king. ech a ge .com/de ini ion/deep-packe -inspec ion-DPI
Re ie ed: Ap il 11 h 2017.
[
36
] “RTI: NASA Human Explo a ion Tele obo is”. (h p://www.omg.o g/ho -
opics/documen s/dds/NASA_Tele obo ics.pd )
[
37
] D. C. Schmid , A. Co sa o and H. an’ Hag. “Add essing he Challenges o
Tac ical In o ma ion Managemen in Ne -Cen ic Sys ems Wi h DDS”, 2008.
[
38
] RTI: “Why is DDS he Righ Technology o he Indus ial In e ne ?”
(h p://omgwiki.o g/dds/si es/de aul / iles/RTILunchAdd essOMG2014 2.pd )
[
39
] RTI communi y – Da aW i e s/Publishe s and Da aReade s/Subsc ibe s
(h ps://communi y. i.com/s a ic/documen a ion/connex -
dds/5.2.3/doc/manuals/connex _dds/h ml_ iles/RTI_Connex DDS_Co eLib a ies_Use s
Manual/Con en /Use sManual/Da aW i e s_Publishe s_and_Da aReade s.h m)
[
40
] OMG – “The Real- ime Publish-Subsc ibe Wi e P o ocol DDS In e ope abili y
Wi e P o ocol Speci ica ion”, 2008.
[
41
] V. Veselý, O. Ryša ý and M. Š éda. “P o ocol Indepen en Mul icas in
OMNeT++”, 2014.
[
42
] B. Cain, S. Dee ing, I. Kou elas, B. Fenne and A. Thyaga ajan. “RFC 3376:
In e ne G oup Managemen P o ocol, Ve sion 3.” (h ps:// ools.ie .o g/h ml/ c3376)
[
43
] U. Goyal, G. Bha i and P. Singh. “A No el F amewo k o Mi iga ing DDoS
A acks”, 2013.
[
44
] P ism ech – OpenSplice DDS.
(h p://www.p ism ech.com/si es/de aul / iles/documen s/OpenSplice_DDS_ATC_AT
M_O e iew.pd )
[
45
] R. A. Sahne adn K. S. T i edi (IEEE). “Pe o mance and Reliabili y Analysis
Using Di ec ed Acyclic G aphs”, 1987.
[
46
] Da id G. Sulli an (Ha a d Ex ension School). “Bina y T ees and Hu man
Encoding Bina y Sea ch T ees”, 2012.
[
47
] C. T. Sil a, J. S. B. Mi chell and P. L. Williams. “An Ex ac In e ac i e Time
Visibili y O de ing Algo i hm o Polyhed al Cell Complexes”.
P i a e Ne wo ks In usion De ec ion Sys em by Sa is ying Ne wo k Cons ain s
72
[
48
] Memcpy(3) Linux P og amme ’s Manual. (h p://man7.o g/linux/man-
pages/man3/memcpy.3.h ml) Re ie ed: Ap il 13 h 2017.
[
49
] J. T iple , P. E. McKenney and J. Walpole. “Resizable, Scalable, Concu en Hash
Tables”.
[
50
] N. CANADA. “A Canada: Media – he Canadian Au oma ed Ai T a ic Sys em”
(h p://www.na canada.ca/EN/media/Pages/publica ionsco po a e-di ec - ou e-s o y-
1.aspx.)
[
51
] G. Csmak. “Eu oscope – Powe o Con ol” (h p://www.eu oscope.hu.)
[52] Siam Hasan and T. R. Dean. “A cons ain -based IDS”. (Pending o e ision o
publica ion)