Intrusion Detection Networks A Key to Collaborative

Security 1st Edition Carol Fung - Downloadable PDF

2025

https://ebookfinal.com/download/intrusion-detection-networks-a-key-to-
collaborative-security-1st-edition-carol-fung/

Visit ebookfinal.com today to download the complete set of

ebooks or textbooks
Here are some recommended products that we believe you will be
interested in. You can click the link to download.

Network Intrusion Detection 3rd Edition Stephen Northcutt

https://ebookfinal.com/download/network-intrusion-detection-3rd-
edition-stephen-northcutt/

Intrusion Detection and Prevention 1st Edition Carl Endorf

https://ebookfinal.com/download/intrusion-detection-and-
prevention-1st-edition-carl-endorf/

Security Monitoring Proven Methods for Incident Detection

on Enterprise Networks 1st Edition Chris Fry

https://ebookfinal.com/download/security-monitoring-proven-methods-
for-incident-detection-on-enterprise-networks-1st-edition-chris-fry/

Network Security Technologies 2nd Edition Kwok T. Fung

https://ebookfinal.com/download/network-security-technologies-2nd-
edition-kwok-t-fung/
Security in Sensor Networks 1st Edition Yang Xiao

https://ebookfinal.com/download/security-in-sensor-networks-1st-
edition-yang-xiao/

Israel s Security Networks A Theoretical and Comparative

Perspective 1st Edition Gabriel Sheffer

https://ebookfinal.com/download/israel-s-security-networks-a-
theoretical-and-comparative-perspective-1st-edition-gabriel-sheffer/

Security in Wireless Mesh Networks 1st Edition Yan Zhang

https://ebookfinal.com/download/security-in-wireless-mesh-
networks-1st-edition-yan-zhang/

Raise the Issues An Integrated Approach to Critical

Thinking Answer Key and Audioscript 3rd Edition Carol
Numrich
https://ebookfinal.com/download/raise-the-issues-an-integrated-
approach-to-critical-thinking-answer-key-and-audioscript-3rd-edition-
carol-numrich/

Security of e Systems and Computer Networks 1st Edition

Mohammad Obaidat

https://ebookfinal.com/download/security-of-e-systems-and-computer-
networks-1st-edition-mohammad-obaidat/
Intrusion Detection Networks A Key to Collaborative
Security 1st Edition Carol Fung Digital Instant Download
Author(s): Carol Fung, Raouf Boutaba
ISBN(s): 9781466564138, 146656413X
Edition: 1
File Details: PDF, 4.88 MB
Year: 2013
Language: english
 Information Technology / Security & Auditing

Boutaba
Fung
The rapidly increasing sophistication of cyber intrusions makes them nearly
impossible to detect without the use of a collaborative intrusion detection network
(IDN). Using overlay networks that allow an intrusion detection system (IDS) to
Intrusion Detection
exchange information, IDNs can dramatically improve your overall intrusion
detection accuracy. Networks

Intrusion Detection Networks

Intrusion Detection Networks: A Key to Collaborative Security focuses on the
design of IDNs and explains how to leverage effective and efficient collaboration
between participant IDSs. Providing a complete introduction to IDSs and IDNs, it
A Key to Collaborative Security
explains the benefits of building IDNs, identifies the challenges underlying their
design, and outlines possible solutions to these problems. It also reviews the full
range of proposed IDN solutions—analyzing their scope, topology, strengths,
weaknesses, and limitations.

• Includes a case study that examines the applicability of collaborative Carol Fung and Raouf Boutaba
intrusion detection to real-world malware detection scenarios
• Illustrates distributed IDN architecture design
• Considers trust management, intrusion detection decision making,
resource management, and collaborator management

The book provides a complete overview of network intrusions, including their

potential damage and corresponding detection methods. Covering the range of
existing IDN designs, it elaborates on privacy, malicious insiders, scalability, free-
riders, collaboration incentives, and intrusion detection efficiency. It also provides
a collection of problem solutions to key IDN design challenges and shows how you
can use various theoretical tools in this context.

The text outlines comprehensive validation methodologies and metrics to help you
improve efficiency of detection, robustness against malicious insiders, incentive
compatibility for all participants, and scalability in network size. It concludes by
highlighting open issues and future challenges.

K16024
6000 Broken Sound Parkway, NW
Suite 300, Boca Raton, FL 33487 ISBN: 978-1-4665-6412-1
711 Third Avenue 90000
New York, NY 10017
an informa business
2 Park Square, Milton Park
www.crcpress.com Abingdon, Oxon OX14 4RN, UK
9 781466 564121
www.auerbach-publications.com

K16024 cvr mech.indd 1 10/15/13 10:27 AM

Intrusion Detection
Networks
A Key to Collaborative Security
This page intentionally left blank
Intrusion Detection
Networks
A Key to Collaborative Security

Carol Fung and Raouf Boutaba

CRC Press
Taylor & Francis Group
6000 Broken Sound Parkway NW, Suite 300
Boca Raton, FL 33487-2742

© 2014 by Taylor & Francis Group, LLC

CRC Press is an imprint of Taylor & Francis Group, an Informa business

No claim to original U.S. Government works

Version Date: 20131108

International Standard Book Number-13: 978-1-4665-6413-8 (eBook - PDF)

This book contains information obtained from authentic and highly regarded sources. Reasonable efforts
have been made to publish reliable data and information, but the author and publisher cannot assume
responsibility for the validity of all materials or the consequences of their use. The authors and publishers
have attempted to trace the copyright holders of all material reproduced in this publication and apologize to
copyright holders if permission to publish in this form has not been obtained. If any copyright material has
not been acknowledged please write and let us know so we may rectify in any future reprint.

Except as permitted under U.S. Copyright Law, no part of this book may be reprinted, reproduced, transmit-
ted, or utilized in any form by any electronic, mechanical, or other means, now known or hereafter invented,
including photocopying, microfilming, and recording, or in any information storage or retrieval system,
without written permission from the publishers.

For permission to photocopy or use material electronically from this work, please access www.copyright.
com (http://www.copyright.com/) or contact the Copyright Clearance Center, Inc. (CCC), 222 Rosewood
Drive, Danvers, MA 01923, 978-750-8400. CCC is a not-for-profit organization that provides licenses and
registration for a variety of users. For organizations that have been granted a photocopy license by the CCC,
a separate system of payment has been arranged.

Trademark Notice: Product or corporate names may be trademarks or registered trademarks, and are used
only for identification and explanation without intent to infringe.
Visit the Taylor & Francis Web site at
http://www.taylorandfrancis.com

and the CRC Press Web site at

http://www.crcpress.com
Contents

List of Figures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xiii

List of Tables . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii

Preface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xix

About the Authors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xxi

SECTION I: INTRODUCTION 1

SECTION II: CYBER INTRUSIONS AND INTRUSION

DETECTION 7
2 Cyber Intrusions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
2.2 Overview of Cyber Intrusions . . . . . . . . . . . . . . . . . . . . 10
2.2.1 Malware . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
2.2.2 Vulnerabilities Exploitation . . . . . . . . . . . . . . . . . 11
2.2.3 Denial-of-Service Attack . . . . . . . . . . . . . . . . . . . 12
2.2.4 Web-Based Attacks . . . . . . . . . . . . . . . . . . . . . . 13
2.2.5 DNS Attack . . . . . . . . . . . . . . . . . . . . . . . . . . 14
2.2.6 Organized Attacks and Botnets . . . . . . . . . . . . . . . . 15
2.2.7 Spam and Phishing . . . . . . . . . . . . . . . . . . . . . . 15
2.2.8 Mobile Device Security . . . . . . . . . . . . . . . . . . . 17
2.2.9 Cyber Crime and Cyber Warfare . . . . . . . . . . . . . . . 17
2.3 A Taxonomy of Cyber Intrusions . . . . . . . . . . . . . . . . . . 18
2.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18

v
vi  Contents

3 Intrusion Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
3.1 Intrusion Detection Systems . . . . . . . . . . . . . . . . . . . . . 22
3.1.1 Signature-Based and Anomaly-Based IDSs . . . . . . . . . 22
3.1.2 Host-Based and Network-Based IDSs . . . . . . . . . . . . 22
3.1.3 Other Types of IDSs . . . . . . . . . . . . . . . . . . . . . 24
3.1.4 Strength and Limitations of IDSs . . . . . . . . . . . . . . 24
3.2 Collaborative Intrusion Detection Networks . . . . . . . . . . . . . 25
3.2.1 Motivation for IDS Collaboration . . . . . . . . . . . . . . 25
3.2.2 Challenges of IDS Collaboration . . . . . . . . . . . . . . . 25
3.3 Overview of Existing Intrusion Detection Networks . . . . . . . . . 26
3.3.1 Cooperation Topology . . . . . . . . . . . . . . . . . . . . 26
3.3.2 Cooperation Scope . . . . . . . . . . . . . . . . . . . . . . 27
3.3.3 Collaboration Type . . . . . . . . . . . . . . . . . . . . . . 27
3.3.4 Specialization . . . . . . . . . . . . . . . . . . . . . . . . . 28
3.3.5 Cooperation Technologies and Algorithms . . . . . . . . . 28
3.3.5.1 Data Correlation . . . . . . . . . . . . . . . . . . 28
3.3.5.2 Trust Management . . . . . . . . . . . . . . . . . 29
3.3.5.3 Load Balancing . . . . . . . . . . . . . . . . . . 29
3.3.6 Taxonomy . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3.4 Selected Intrusion Detection Networks . . . . . . . . . . . . . . . 29
3.4.1 Indra . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
3.4.2 DOMINO . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
3.4.3 DShield . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.4.4 NetShield . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.4.5 CIDS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
3.4.6 Gossip . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
3.4.7 Worminator . . . . . . . . . . . . . . . . . . . . . . . . . . 34
3.4.8 ABDIAS . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
3.4.9 CRIM . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.4.10 ALPACAS . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.4.11 CDDHT . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35
3.4.12 SmartScreen Filter . . . . . . . . . . . . . . . . . . . . . . 35
3.4.13 CloudAV . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
3.4.14 FFCIDN . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
3.4.15 CMDA . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
3.5 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

SECTION III: DESIGN OF AN INTRUSION DETECTION

NETWORK 39
4 Collaborative Intrusion Detection Networks Architecture Design . . . 41
4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 42
4.2 Collaboration Framework . . . . . . . . . . . . . . . . . . . . . . 42
4.2.1 Network Join Process . . . . . . . . . . . . . . . . . . . . . 44
4.2.2 Consultation Requests . . . . . . . . . . . . . . . . . . . . 45
 Contents  vii

4.2.3 Test Messages . . . . . . . . . . . . . . . . . . . . . . . . 46

4.2.4 Communication Overlay . . . . . . . . . . . . . . . . . . . 46
4.2.5 Mediator . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
4.2.6 Trust Management . . . . . . . . . . . . . . . . . . . . . . 46
4.2.7 Acquaintance Management . . . . . . . . . . . . . . . . . . 47
4.2.8 Resource Management . . . . . . . . . . . . . . . . . . . . 47
4.2.9 Feedback Aggregation . . . . . . . . . . . . . . . . . . . . 47
4.3 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
4.3.1 Privacy Issues . . . . . . . . . . . . . . . . . . . . . . . . . 48
4.3.2 Insider Attacks . . . . . . . . . . . . . . . . . . . . . . . . 48
4.4 Summary . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

5 Trust Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51
5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
5.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
5.3 Trust Management Model . . . . . . . . . . . . . . . . . . . . . . 55
5.3.1 Satisfaction Mapping . . . . . . . . . . . . . . . . . . . . . 55
5.3.2 Dirichlet-Based Model . . . . . . . . . . . . . . . . . . . . 56
5.3.3 Evaluating the Trustworthiness of a Peer . . . . . . . . . . . 57
5.4 Test Message Exchange Rate and Scalability of Our System . . . . 59
5.5 Robustness against Common Threats . . . . . . . . . . . . . . . . 60
5.5.1 Newcomer Attacks . . . . . . . . . . . . . . . . . . . . . . 60
5.5.2 Betrayal Attacks . . . . . . . . . . . . . . . . . . . . . . . 60
5.5.3 Collusion Attacks . . . . . . . . . . . . . . . . . . . . . . . 61
5.5.4 Inconsistency Attacks . . . . . . . . . . . . . . . . . . . . 61
5.6 Simulations and Experimental Results . . . . . . . . . . . . . . . . 61
5.6.1 Simulation Setting . . . . . . . . . . . . . . . . . . . . . . 61
5.6.2 Modeling the Expertise Level of a Peer . . . . . . . . . . . 62
5.6.3 Deception Models . . . . . . . . . . . . . . . . . . . . . . 63
5.6.4 Trust Values and Confidence Levels for Honest Peers . . . . 63
5.6.5 Trust Values for Dishonest Peers . . . . . . . . . . . . . . . 64
5.6.6 Robustness of Our Trust Model . . . . . . . . . . . . . . . 66
5.6.7 Scalability of Our Trust Model . . . . . . . . . . . . . . . . 69
5.6.8 Efficiency of Our Trust Model . . . . . . . . . . . . . . . . 69
5.7 Conclusions and Future Work . . . . . . . . . . . . . . . . . . . . 71

6 Collaborative Decision . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
6.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74
6.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
6.3 Collaborative Decision Model . . . . . . . . . . . . . . . . . . . . 75
6.3.1 Modeling of Acquaintances . . . . . . . . . . . . . . . . . 77
6.3.2 Collaborative Decision . . . . . . . . . . . . . . . . . . . . 79
6.4 Sequential Hypothesis Testing . . . . . . . . . . . . . . . . . . . . 80
6.4.1 Threshold Approximation . . . . . . . . . . . . . . . . . . 83
6.5 Performance Evaluation . . . . . . . . . . . . . . . . . . . . . . . 84
viii  Contents

6.5.1 Simulation Setting . . . . . . . . . . . . . . . . . . . . . . 85

6.5.1.1 Simple Average Model . . . . . . . . . . . . . . 85
6.5.1.2 Weighted Average Model . . . . . . . . . . . . . 86
6.5.1.3 Bayesian Decision Model . . . . . . . . . . . . . 86
6.5.2 Modeling of a Single IDS . . . . . . . . . . . . . . . . . . 86
6.5.3 Detection Accuracy and Cost . . . . . . . . . . . . . . . . . 88
6.5.3.1 Cost under Homogeneous Environment . . . . . . 89
6.5.3.2 Cost under Heterogeneous Environment . . . . . 89
6.5.3.3 Cost and the Number of Acquaintances . . . . . . 90
6.5.4 Sequential Consultation . . . . . . . . . . . . . . . . . . . 92
6.5.5 Robustness and Scalability of the System . . . . . . . . . . 95
6.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 96

7 Resource Management . . . . . . . . . . . . . . . . . . . . . . . . . . 97
7.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97
7.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98
7.3 Resource Management and Incentive Design . . . . . . . . . . . . 100
7.3.1 Modeling of Resource Allocation . . . . . . . . . . . . . . 100
7.3.2 Characterization of Nash Equilibrium . . . . . . . . . . . . 103
7.3.3 Incentive Properties . . . . . . . . . . . . . . . . . . . . . . 105
7.4 Primal / Dual Iterative Algorithm . . . . . . . . . . . . . . . . . . 107
7.5 Experiments and Evaluation . . . . . . . . . . . . . . . . . . . . . 110
7.5.1 Nash Equilibrium Computation . . . . . . . . . . . . . . . 110
7.5.2 Nash Equilibrium Using Distributed Computation . . . . . . 111
7.5.3 Robustness Evaluation . . . . . . . . . . . . . . . . . . . . 114
7.5.3.1 Free-Riding . . . . . . . . . . . . . . . . . . . . 114
7.5.3.2 Denial-of-Service (DoS) Attacks . . . . . . . . . 115
7.5.3.3 Dishonest Insiders . . . . . . . . . . . . . . . . . 115
7.5.4 Large-Scale Simulation . . . . . . . . . . . . . . . . . . . . 117
7.6 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117

8 Collaborators Selection and Management . . . . . . . . . . . . . . . . 119

8.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120
8.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121
8.3 IDS Identification and Feedback Aggregation . . . . . . . . . . . . 122
8.3.1 Detection Accuracy for a Single IDS . . . . . . . . . . . . . 123
8.3.2 Feedback Aggregation . . . . . . . . . . . . . . . . . . . . 124
8.4 Acquaintance Management . . . . . . . . . . . . . . . . . . . . . 126
8.4.1 Problem Statement . . . . . . . . . . . . . . . . . . . . . . 126
8.4.2 Acquaintance Selection Algorithm . . . . . . . . . . . . . . 128
8.4.3 Acquaintance Management Algorithm . . . . . . . . . . . . 130
8.5 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132
8.5.1 Simulation Setting . . . . . . . . . . . . . . . . . . . . . . 132
8.5.2 Determining the Test Message Rate . . . . . . . . . . . . . 132
8.5.3 Efficiency of Our Feedback Aggregation . . . . . . . . . . 134
 Contents  ix

8.5.4 Cost and the Number of Collaborators . . . . . . . . . . . . 135

8.5.5 Efficiency of Acquaintance Selection Algorithms . . . . . . 136
8.5.6 Evaluation of Acquaintance Management Algorithm . . . . 137
8.5.6.1 Convergence . . . . . . . . . . . . . . . . . . . . 137
8.5.6.2 Stability . . . . . . . . . . . . . . . . . . . . . . 139
8.5.6.3 Incentive Compatibility . . . . . . . . . . . . . . 141
8.5.6.4 Robustness . . . . . . . . . . . . . . . . . . . . . 141
8.6 Conclusion and Future Work . . . . . . . . . . . . . . . . . . . . . 142

SECTION IV: OTHER TYPES OF IDN DESIGN 145

9 Knowledge-Based Intrusion Detection Networks and Knowledge Prop-
agation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147
9.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 148
9.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150
9.3 Knowledge Sharing IDN Architecture . . . . . . . . . . . . . . . . 151
9.3.1 Network Topology . . . . . . . . . . . . . . . . . . . . . . 151
9.3.2 Communication Framework . . . . . . . . . . . . . . . . . 152
9.3.3 Snort Rules . . . . . . . . . . . . . . . . . . . . . . . . . . 153
9.3.4 Authenticated Network Join Operation . . . . . . . . . . . 154
9.3.5 Feedback Collector . . . . . . . . . . . . . . . . . . . . . . 154
9.3.6 Trust Evaluation and Acquaintance Management . . . . . . 155
9.3.7 Knowledge Propagation Control . . . . . . . . . . . . . . . 156
9.3.8 An Example . . . . . . . . . . . . . . . . . . . . . . . . . 157
9.4 Knowledge Sharing and Propagation Model . . . . . . . . . . . . . 157
9.4.1 Lower Level – Public Utility Optimization . . . . . . . . . 159
9.4.2 Upper Level – Private Utility Optimization . . . . . . . . . 161
9.4.3 Tuning Parameter Ri j . . . . . . . . . . . . . . . . . . . . . 162
9.4.4 Nash Equilibrium . . . . . . . . . . . . . . . . . . . . . . . 164
9.4.5 Price of Anarchy Analysis . . . . . . . . . . . . . . . . . . 165
9.4.6 Knowledge Propagation . . . . . . . . . . . . . . . . . . . 166
9.5 Bayesian Learning and Dynamic Algorithms . . . . . . . . . . . . 167
9.5.1 Bayesian Learning Model for Trust . . . . . . . . . . . . . 168
9.5.1.1 Dirichlet Learning Model for Knowledge Quality 168
9.5.1.2 Credible-Bound Estimation of Trust . . . . . . . 168
9.5.2 Dynamic Algorithm to Find the Prime NE at Node . . . . . 169
9.6 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 171
9.6.1 Simulation Setup . . . . . . . . . . . . . . . . . . . . . . . 172
9.6.2 Trust Value Learning . . . . . . . . . . . . . . . . . . . . . 172
9.6.3 Convergence of Distributed Dynamic Algorithm . . . . . . 176
9.6.4 Scalability and Quality of Information (QoI) . . . . . . . . 176
9.6.5 Incentive Compatibility and Fairness . . . . . . . . . . . . 177
9.6.6 Robustness of the System . . . . . . . . . . . . . . . . . . 179
9.7 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 180
x  Contents

10 Collaborative Malware Detection Networks . . . . . . . . . . . . . . . 181

10.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 182
10.2 Background . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 184
10.2.1 Collaborative Malware Detection . . . . . . . . . . . . . . 184
10.2.2 Decision Models for Collaborative Malware Detection . . . 184
10.2.2.1 Static Threshold . . . . . . . . . . . . . . . . . . 185
10.2.2.2 Weighted Average . . . . . . . . . . . . . . . . . 185
10.2.2.3 Decision Tree . . . . . . . . . . . . . . . . . . . 185
10.2.2.4 Bayesian Decision . . . . . . . . . . . . . . . . . 185
10.3 Collaboration Framework . . . . . . . . . . . . . . . . . . . . . . 185
10.3.1 Architecture Design . . . . . . . . . . . . . . . . . . . . . 187
10.3.2 Communication Overhead and Privacy Issue . . . . . . . . 188
10.3.3 Adversaries and Free-Riding . . . . . . . . . . . . . . . . . 189
10.4 Collaborative Decision Model . . . . . . . . . . . . . . . . . . . . 189
10.4.1 Problem Statement and RevMatch Model . . . . . . . . . . 189
10.4.2 Feedback Relaxation . . . . . . . . . . . . . . . . . . . . . 192
10.4.3 Labeled History Update . . . . . . . . . . . . . . . . . . . 193
10.5 Evaluation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
10.5.1 Data Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . 194
10.5.2 Experiment Setting . . . . . . . . . . . . . . . . . . . . . . 196
10.5.3 Ranking of AVs . . . . . . . . . . . . . . . . . . . . . . . . 196
10.5.4 Static Threshold . . . . . . . . . . . . . . . . . . . . . . . 197
10.5.5 Weighted Average . . . . . . . . . . . . . . . . . . . . . . 197
10.5.6 Decision Tree . . . . . . . . . . . . . . . . . . . . . . . . . 197
10.5.7 Bayesian Decision . . . . . . . . . . . . . . . . . . . . . . 200
10.5.8 RevMatch . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
10.5.9 Comparison between Different Decision Models . . . . . . 201
10.5.10 Robustness against Insider Attacks . . . . . . . . . . . . . . 203
10.5.11 Acquaintance List Length and Efficiency . . . . . . . . . . 205
10.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206
10.6.1 Runtime Efficiency on Decision . . . . . . . . . . . . . . . 206
10.6.2 Partial Feedback . . . . . . . . . . . . . . . . . . . . . . . 206
10.6.3 Tuning Flexibility . . . . . . . . . . . . . . . . . . . . . . . 207
10.6.4 Comparison . . . . . . . . . . . . . . . . . . . . . . . . . . 207
10.6.5 Zero-Day Malware Detection . . . . . . . . . . . . . . . . 207
10.6.6 Historical Data Poisoning Attack . . . . . . . . . . . . . . . 207
10.7 Conclusion and Future Work . . . . . . . . . . . . . . . . . . . . . 208

SECTION V: CONCLUSION 209

SECTION VI: APPENDICES 213

A Examples of Intrusion Detection Rules and Alerts . . . . . . . . . . . 215
A.1 Examples of Snort Rules . . . . . . . . . . . . . . . . . . . . . . . 215
A.2 Example of an Intrusion Alert in IDMEF Format . . . . . . . . . . 216
 Contents  xi

B Proofs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 219
B.1 Proof of Proposition 9.4.3 . . . . . . . . . . . . . . . . . . . . . . 219
B.2 Proof of Theorem 9.2 . . . . . . . . . . . . . . . . . . . . . . . . . 220
B.3 Proof of Proposition 9.4.4 . . . . . . . . . . . . . . . . . . . . . . 221
B.4 Proof of Proposition 9.4.5 . . . . . . . . . . . . . . . . . . . . . . 221
B.5 Proof of Proposition 9.4.6 . . . . . . . . . . . . . . . . . . . . . . 221

References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223

Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 237
This page intentionally left blank
List of Figures

2.1 The DNS spoofing attack. . . . . . . . . . . . . . . . . . . . . . . 14

2.2 The life cycle of a bot node. . . . . . . . . . . . . . . . . . . . . . 16
2.3 A taxonomy of cyber intrusions. . . . . . . . . . . . . . . . . . . 19

3.1 An example of host-based IDS and network-based IDS. . . . . . . 23

3.2 Indra architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . 31
3.3 DOMINO architecture. . . . . . . . . . . . . . . . . . . . . . . . 32
3.4 NetShield architecture. . . . . . . . . . . . . . . . . . . . . . . . 33
3.5 ABDIAS architecture. . . . . . . . . . . . . . . . . . . . . . . . . 34
3.6 Topology design for collaborative malware detection on Android. . 37

4.1 Topology of a consultation-based collaborative intrusion detection

network. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43
4.2 Communication protocol design for IDN. . . . . . . . . . . . . . . 44
4.3 Architecture design of an IDN. . . . . . . . . . . . . . . . . . . . 45

5.1 Satisfaction level for feedback (r = 0.5, c1 = 2, c2 = 1). . . . . . . 56

5.2 Decision density function for expertise levels. . . . . . . . . . . . 63
5.3 Feedback curves for different deception strategies. . . . . . . . . . 64
5.4 Convergence of trust values for different expertise levels. . . . . . 65
5.5 Confidence levels of estimation for different test message rates. . . 65
5.6 Trust values of deceptive peers with different deception strategies. . 66
5.7 Trust values of newcomers under different trust models. . . . . . . 67
5.8 Trust of malicious peers under betrayal attack. . . . . . . . . . . . 68
5.9 Impact on accuracy of betrayal attack. . . . . . . . . . . . . . . . 69
5.10 Comparison of average test message rates under different models. . 70
5.11 Aggregated feedback under inconsistency attack. . . . . . . . . . . 70
5.12 Intrusion detection success rate under inconsistency attack. . . . . 71

6.1 Expertise level and detection rate. . . . . . . . . . . . . . . . . . . 87

xiii
xiv  Intrusion Detection Networks: A Key to Collaborative Security

6.2 FP and FN versus expertise level l. . . . . . . . . . . . . . . . . . 88

6.3 FP and FN versus threshold τ p . . . . . . . . . . . . . . . . . . . . 89
6.4 Average cost versus threshold τ p . . . . . . . . . . . . . . . . . . . 90
6.5 Average costs for three different aggregation models. . . . . . . . 91
6.6 Comparison of three aggregation models. . . . . . . . . . . . . . . 91
6.7 Average cost versus number of acquaintances consulted (Ug is the
cost goal). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
6.8 Cost versus C01 for the three models. . . . . . . . . . . . . . . . . 93
6.9 FP, TP versus number of acquaintances. . . . . . . . . . . . . . . 93
6.10 Number of acquaintances versus expertise. . . . . . . . . . . . . . 94
6.11 False positive and true positive of single IDS under betrayal attack. 94
6.12 False decision cost under betrayal attack. . . . . . . . . . . . . . . 95

7.1 Helping resources versus time—first approach. . . . . . . . . . . . 110

7.2 Helping resource received varies with trust value—first approach. . 111
7.3 Helping resource received varies with resource contribution—first
approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112
7.4 Helping resources versus time—second approach. . . . . . . . . . 113
7.5 Helping resource received varies with trust value—second ap-
proach. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113
7.6 Helping resource received varies with resource contribution—
second approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
7.7 Resource received versus exchanged upper-bound. . . . . . . . . . 115
7.8 Resource received after free-riding attack. . . . . . . . . . . . . . 116
7.9 Resource received for peers with different trust values. . . . . . . . 116
7.10 Resource received for peers with different resource capacities. . . . 117

8.1 Bayes risk for optimal decisions when C f p = 1 and C f n = 5. . . . . 127

8.2 The convergence of learning speed and the test message rate. . . . 133
8.3 The distribution of estimated FN rate (R = 10/day). . . . . . . . . 134
8.4 Comparison of cost using threshold decision and Bayesian decision. 135
8.5 The average cost under different collaborator quality. . . . . . . . 136
8.6 The cost using different acquaintance selection algorithms. . . . . 137
8.7 The running time using different acquaintance selection algorithms. 138
8.8 Acquaintances distribution on day 25. . . . . . . . . . . . . . . . . 138
8.9 Acquaintances distribution on day 200. . . . . . . . . . . . . . . . 139
8.10 The average cost for collaboration. . . . . . . . . . . . . . . . . . 140
8.11 The collaboration time span. . . . . . . . . . . . . . . . . . . . . . 140
8.12 The converged cost distribution. . . . . . . . . . . . . . . . . . . . 141
8.13 The FP and FN of betrayal node. . . . . . . . . . . . . . . . . . . 142
8.14 The cost of an IDS under a betrayal attack. . . . . . . . . . . . . . 143

9.1 Topology of a knowledge-based intrusion detection network, where

IDSs are connected to a peer-to-peer network and share intrusion
detection knowledge with others. . . . . . . . . . . . . . . . . . . 152
 List of Figures  xv

9.2 SMURFEN design of eight nodes on a Chord ring. . . . . . . . . . 153

9.3 An example Snort rule. . . . . . . . . . . . . . . . . . . . . . . . 154
9.4 An example of dependent Snort rules. . . . . . . . . . . . . . . . . 154
9.5 Feedback collection in SMURFEN. . . . . . . . . . . . . . . . . . 155
9.6 An example of knowledge propagation path. . . . . . . . . . . . . 156
9.7 An illustration of the rule propagation protocol. . . . . . . . . . . 159
9.8 An illustrative example of a three-person system involving the set
of nodes {i, 1, 2}. Node i solves (PPi) while nodes 1 and 2 solve
(P1i) and (P2i), respectively. . . . . . . . . . . . . . . . . . . . . . 163
9.9 The comparison of information quality. . . . . . . . . . . . . . . . 173
9.10 Incentive on expertise level. . . . . . . . . . . . . . . . . . . . . . 173
9.11 Incentive of contribution rate. . . . . . . . . . . . . . . . . . . . . 174
9.12 The influence from a betrayal attack. . . . . . . . . . . . . . . . . 174
9.13 Compatibility under different learning methods. . . . . . . . . . . 175
9.14 The credible-bound compatibility versus sample rate. . . . . . . . 175
9.15 The convergence of dynamic algorithm. . . . . . . . . . . . . . . 176
9.16 The comparison of scalability. . . . . . . . . . . . . . . . . . . . . 178
9.17 The influence versus sending rate. . . . . . . . . . . . . . . . . . . 178

10.1 Topology design of collaborative malware detection network. . . . 186

10.2 Architecture desgin of a trader node in CMDN. . . . . . . . . . . . 188
10.3 An example of the RevMatch decision algorithm for CMDNs. . . . 192
10.4 True positive rate and false positive rate of AVs. . . . . . . . . . . 197
10.5 TP, FP, and quality scores of static threshold-based model with dif-
ferent thresholds (based on data set S3, S6). . . . . . . . . . . . . 199
10.6 TP, FP, and quality scores of weighted average model with different
thresholds (based on data set S3, S6). . . . . . . . . . . . . . . . . 199
10.7 The optimal decision tree generated by Weka J48 Algorithm (top 5
levels). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 200
10.8 The iImpact from τc in RevMatch model. . . . . . . . . . . . . . . 201
10.9 The impact from C f n in RevMatch model. . . . . . . . . . . . . . 202
10.10 Quality scores of all models with different C f n . . . . . . . . . . . . 202
10.11 RevMatch model under three different attacks. . . . . . . . . . . . 204
10.12 The quality scores versus the number of attackers. . . . . . . . . . 204
10.13 The quality scores versus number of collaborators. . . . . . . . . . 205

A.1 Structure of a Snort Rule. . . . . . . . . . . . . . . . . . . . . . . 216

A.2 Example of an intrusion alert in IDMEF format. . . . . . . . . . . 217
This page intentionally left blank
List of Tables

3.1 Classification of Cooperative Intrusion Detection Networks. . . . . 30

5.1 Acquaintance Categorization . . . . . . . . . . . . . . . . . . . . 60

5.2 Simulation Parameters . . . . . . . . . . . . . . . . . . . . . . . . 62

6.1 Summary of Notations . . . . . . . . . . . . . . . . . . . . . . . . 76

6.2 Simulation Parameters . . . . . . . . . . . . . . . . . . . . . . . . 85

7.1 Summary of Notations . . . . . . . . . . . . . . . . . . . . . . . . 100

8.1 Summary of Notations . . . . . . . . . . . . . . . . . . . . . . . . 123

8.2 Simulation Parameters . . . . . . . . . . . . . . . . . . . . . . . . 133

9.1 Summary of Notations . . . . . . . . . . . . . . . . . . . . . . . . 158

9.2 Simulation Parameters . . . . . . . . . . . . . . . . . . . . . . . . 172

10.1 Summary of Notations . . . . . . . . . . . . . . . . . . . . . . . . 190

10.2 Data Sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 195
10.3 Antiviruses Used for Evaluation (presented in alphabetical order) . 196
10.4 Quality Ranking for Antiviruses . . . . . . . . . . . . . . . . . . . 198
10.5 Quality Scores among Different Decision Models . . . . . . . . . 203
10.6 Performance Summary of Collaborative Decision Models . . . . . 206

xvii
This page intentionally left blank
Preface

The Internet has experienced explosive growth. Along with the widespread deploy-
ment of new emerging services, billions of computers and devices are connected
to the Internet and are accessible worldwide. At the same time, the growing size
and complexity of computer software leave thousands of software vulnerabilities ex-
posed for malicious exploitations. Millions of attacks and billions of dollars of loss
are reported every year as the result of cyber crimes. In this context, cyber intrusions
are becoming an increasingly global and urgent problem. As a countermeasure, In-
trusion Detection Systems (IDSs) are designed to identify intrusions by comparing
observable behavior against suspicious patterns, and notify administrators by raising
intrusion alarms. An IDS can be broadly defined as software or a device capable of
monitoring network or computer activities and raising alerts when suspicious activ-
ities are observed. Examples of IDS can be antivirus software, network-based IDS
(e.g., Snort, Bro), host-based IDS (e.g., OSSEC, Tripwire), honeynets, and firewalls.
Traditional IDSs work in isolation and can be easily compromised by threats
that are new or unknown to their providers. An Intrusion Detection Network (IDN)
is an overlay network composed of a number of IDSs. It intends to overcome the
weakness of isolated IDSs by allowing them to share their intrusion information
and detection knowledge with others, this way improving the overall accuracy of
intrusion assessment. However, building an effective IDN is a challenging task. For
example, adversaries may compromise some IDSs in the network and then leverage
the compromised nodes to send false information, spam, or even attack other nodes
in the network, which can compromise the efficiency of the IDN. It is, therefore,
important for an IDN to detect and isolate malicious insiders. Another challenge is
how to make efficient intrusion detection assessment based on the collective infor-
mation and knowledge from other IDSs. Appropriate selection of collaborators and
incentive-compatible resource management in support of IDS interaction with other
peers are also key challenges in IDN design.
This book presents the IDN concept and discusses IDN design with an emphasis
on the following questions: Why build intrusion detection networks; what are the
problems underlying the design of intrusion detection networks; and what are the

xix
Another Random Scribd Document
with Unrelated Content
 ;};{8 PAST AND PRESENT OF ALLAMAKEE COUNTY At the
time of its completion the rolling stock of the road comprised one
twelve-ton locomotive, sixteen box cars, five flats, and one
passenger. The cost of the road and its equipments amounted to
about $121,000, or nearly $5,300 per mile, and its total debt was
about $50,000, bonded for five years. No great splurge or
celebration was indulged in, but on the day of its completion an
impromptu affair was gotten up for the entertainment of the people
who happened to be in town, and the railroad employes in particular,
from an account of which in the Standard we quote as follows : "On
Saturday, October 27, 1877, at 3 o'clock P. M., the engine 'Union
Prairie" rolled up to the platform of the Waukon depot, Thos. Clyde,
engineer: O. H. Bunnell, fireman, and Henry Lear, conductor. For the
preceding few days as the end of the track approached town the
number of visitors had constantly increased, until on this day a large
crowd of people, consisting largely of ladies, were assembled at the
depot and below to witness the last of the track-laying, and get a
sight at the first appearance of our locomotive. When the train
reached the depot platform the flat cars were soon crowded to their
fullest standing room, chiefly by the ladies and children, and the
Waukon band played a joyous strain in welcome. At this point in the
proceedings everybody stood still until the camera had secured a
photograph of the lively scene for all to look at and laugh over in
future years (which is reproduced herewith) ; after which the first
'passenger train,' consisting of five flats, densely packed, ran down
the road a couple of miles, with the band playing on the front car,
and soon returned with whistle sounding, amid considerable
enthusiasm and amusement. * At 5 o'clock, headed by the band, the
hands repaired to Barnard Hall, which had been decorated with
flags, as had also most of the business houses. Here, to the number
of about sixty, they were treated to a bountiful hot supper, including
all the delicacies of the table which the ladies of Waukon so excel in
providing, served by the ladies themselves. After the hands had
satiated their appetites the public generally fell to and did full justice
to the repast; and so amply had the ladies provided for sixty or
eighty railroad hands that it is estimated some live hundred people
were served with supper at the hall, free. * After supper the floor
was cleared and those so disposed participated in a social dance. * *
* There were in town during the day an unusual number of people,
although no public announcement of any demonstration had been
made." The railroad began carrying the mails February 11, 1878. \
month or two before the completion of the road to Waukon, Mr. F.
1'.. ( .ililis, then station agent on the river road at Harper's Ferry,
was engaged to take charge of the new station at Waukon, and he
proved a valuable asset to the new corporation, with its
inexperienced officials, in getting this office into proper working
order. In December following, the American Express Company began
doing business over this line: and November 6, 1879, a telegraph
line was completed; and both these branches of railroading were
added to Mr. Gibbs' duties. The work incident to the opening of a
new office, providing it with the proper books and blanks, and
practically operating this independent line with its insufficient
shipping facilities, was immense, but Mr. Gibbs was equal to the
occasion. When he finally took time to determine whether or not to
make this his home, he decided the question by buying a lot and
building a comfortable dwelling,
 PAST AND PRESENT OF ALLAMAKEE COUNTY 341 and has
for over thirty-five years proven a valuable asset to the business and
social interests of the town, as he had at first been to its railroad
interests. For a third of a century he retained the position of agent at
this station, under the various railroad managements, resigning to
take up the local management of the Upper Iowa Power Company
and electric lighting system, in Waukon. At the annual election of
April 2, 1878, the company elected D. W. Adams, president, H. G.
Grattan, vice president, L. W. Hersey, secretary, C. D. Beeman,
treasurer, and Jas. Holahan, Henry Dayton, W. C. Earle, C. Helming
and C. W. Jenkins, directors. In September, 1878, James F. Joy, of
railroad fame, came here and purchased a controlling interest of the
stockholders, the officers of the Guarantee Company being
succeeded by : J. F. Joy, president ; F. O. Wyatt, vice president and
general manager; C. M. Carter, treasurer; H. H. Stilwell, secretary;
and the road passed into the same management as the river road,
with a prospect of being pushed through into Minnesota. The
officers of the old original company resigned, and were succeeded
by : F. O. Wyatt, president ; W. J. Kivght, vice president; C. M.
Carter, treasurer; H. H. Stilwell, secretary; and Frank Adams, S. A.
Wolcott, J. F. Joy, L. W. Hersey and A. E. Robbins, directors. That fall
and winter a party of surveyors ran a line for a proposed extension
northwest into Minnesota, and also preliminary surveys toward
Decorah, which city in August, "79, voted a four per cent tax in aid
of an extension to that place via Frankville. That route having been
abandoned, grading was begun on the line down Coon Creek, and in
October Decorah again voted a tax to aid in its extension, and the
work was prosecuted vigorously, until stopped by the approach of
winter. In the spring of 1880 grading for the extension was resumed,
the piers erected for four iron bridges across the Oneota river, and
several miles of track laid from Waukon, when, in May, the lines of
the C, C, D. & M. railroad, of which this was a feeder, passed into the
hands of the C, M. & St. P. Railroad Company. It was said that the
Chicago & Northwestern was negotating for these lines, and had
nearly accomplished their purpose when by a little unnecessary
delay in making their final inspection of the properties the game was
lost to the Milwaukee managers, who had been closely watching it
and by the sudden turn of a card secured the stake. As it turned out,
work on the Decorah extension ceased early in July, when the track
had been laid almost to the river; the rails and ties were later taken
up, and the right of way abandoned. In 1885 the road was widened
to standard gauge. THE WAUKON SCHOOLS Early School History
Miss Jessie Lewis The first school of Waukon was out east of town at
what is known as the Four Corners — a little log schoolhouse. Mr. D.
D. Doe taught there in 1853. Then in the winter of 1854-5 L. O.
Hatch taught in town in what is now Nelson Maxwell's house. It
stood then about where E. Dillenberg's residence now stands. It was
a private house, Mr. Israel owning it and living upstairs, the family's
egress and ingress being through the schoolroom.
 342 PAST AND PRESENT OF ALLAMAKEE COUNTY In [855 a
schoolhouse was built and Charles Jenkins was one of the
carpenters. It stood about where the Sisters' school now is. It was
made on the usual plan, with a front door opening into a long hall
and a door at each side, one for girls and one for boys, and wdiat an
ignominious punishment it was for a girl to lie sent out into that cold
hall to meditate on her sins. P.oys were not sent out ; they got a
thrashing then and there, provided the teacher could do it. The seats
inside were in four rows, the first row large, the next smaller and so
on down. Althea Pottle, Ella Hancock and Emma Townsend used to
go early, get the back seat and let the older, larger girls take smaller
seats in front. But they had a good time on that back seat! Mr. Augur
taught in the winter of 1855-6. There was plenty of snow in those
days and no sidewalks to speak of, so Mr. Augur wore heavy boots to
school and took them off there and wore slippers. He used to put his
boots down at the end of the long bench used as a recitation seat.
The day before Christmas the pupils took turns sitting on the end of
the seat near the boots so as to surreptitiously drop his or her
contribution into the boots. They were full by night, mostly
vegetables, and as he had to "board "round," they were not of much
use to him. Miss Susan Shattuck taught the next summer, and in the
winter of 1856-7 Mr. Henry Bigelow was the teacher. [Mr. ISigelow
later lived in Decorah and taught in a commercial college there until
he was assassinated by an insane colleague a few years ago. —
Editor.] He was followed by Mr. Wilbur, Dr. Earle and Mr. Eastman. Mr.
Eastman and wife also taught a private school in the house now
occupied by Superintendent Mills. These gentlemen taught in the
winter, and in the summers Misses Addie Walker, Hannah. Geesey,
Nellie Shattuck, Mate Stillman and Ella Hancock held gentle sway. In
the fall of 1859 Mr. Loughran came and taught in the Presbyterian
church, a private school, until 1862, when a brick schoolhouse was
built by him, where the present schoolhouse stands. It was called
the Allamakee College. The money was raised to build it by selling
scholarships at $125. In 1862 school was held by him in 1 lersey's
hall, adjacent to the present Meyer hotel [now the Allamakee].
Meantime the public school was going on all the time. In 1862
Henrietta lluestis was principal and Emma Townsend assistant.
Professor Loughran sold the property to A. A. Griffith of elocutionary
fame, who sold it to Martin Stone, and he in turn sold it to the
district. After the college became public property the principals down
to the present are given in the following poem by a member of the
present senior class of 1903 ( Miss I [arriet A. I [ancock >. as taken
from her paper at school : When first our school was graded and in
1864 Was moved to this location, from where it was before. The
competent instructor, Mr. Martin Stone by name, Had charge and
jurisdiction, and overlooked the same. This honorable position he
held for two full years. When a certain Thomas Cutler undertook to
show his peers That he was made for teaching and instructing
gentle youth. lie was followed, be it noticed ( for he stayed not long,
in truth), By a Mr. Charles F. Stevens, then by Miss Marie E. Post.
 PAST AND PRESENT OF ALLAMAKEE COUNTY 343 Mr. A. M.
May succeeded, then Miss Keeler helped them learn. Then Charles
Cressy, J. H. Carroll and J. Loughran in his turn. The last named held
the scepter for half a dozen years. Then upon the scene another old-
time preceptor appears, A Mr. David Judson, and so clever was his
rule That many years passed by him before he left the school. Next
there followed S. A. Harper with sway both strong and kind, Then
Mr. Jones had charge one year, and after him we find The name of
C. P. Colgrove, who brought the school good fame. Then H. F. Kling,
E. L. Coffeen (also a goodly name), Mr. Smith and Mr. Macomber,
whose dominion being past, There followed Mr. Dwelle. May he long
remain the last. To go back to early history. The old school building
was bought by O. S. Hathaway and used for a wagon shop. It was
moved down where Heiser's shop now stands. They moved it across
the road, west, and used it as a storing shop. It is now back of John
Hager's wareroom and is used for the same purpose. [It has since
been entirely demolished, in 1907. — Editor.] What stories of good
old times are stored away in that worn old frame. I am reminded of
one romance there. One fair, bright maid was suspected (and rightly,
too) by the teacher, a spruce and courtly gentleman, for having
some reading matter in her desk not only not belonging to school
work, but not good reading for anyone. He demanded the book. She
refused. What could he do? If it were only a boy now, but a girl — a
grown-up young lady, one of his brightest pupils. He gave her her
choice, to give up the book or leave school. She left only to be
promptly sent back by her sensible parents. Either her spirited
resistance or her sweet apology captured the teacher, for a few
years later he married her. The first few years the school took in all
the farming country around, reaching west as far as the Jim Smith
farm, where Ezra Reed then lived, and with all that territory there
were only about twenty-five pupils. One of the classes in those early
days consisted, as near as the writer could obtain the names, of the
following: Clara and Belle Britain, Emma Townsend, Althea Pottle,
Sarah Hersey, Lucinda, George and Rebecca Smith, Frank and Henry
Robbins, Susie Paulk, Ichabod Isted, Watson Hanscom, Granville
Rose, John Sterling Mather, Sarah Reed, Ann Williams, Sarah Pierce
and James Williams. It is to be regretted that records were not kept,
but there are none obtainable any farther back than Prof. D.
Judson's time. Then, in 1876, we find a partial record, and in
January, 1877, we find the attendance in the several rooms as
follows: Prof, and Mrs. D. Judson, 66; Helen Lisher, 46; Jessie Lewis,
39; Ida Thompson, yy ; Mary Duffy, 47. Total, 275. The records take
us down to the present with about 400 pupils, and though we have
the unlucky number of thirteen teachers our school has few equals.
When Professor Loughran built the college he made it his dwelling as
well. His family lived on the first floor and boarded a good many of
the students, who had rooms on the third floor. Professor Loughran
was assisted by his son, Cornelius, and also by W. W. Likens, a Mr.
Brock, Miss Higby, Miss Post and Mrs. Calkins, who taught French,
and Miss Ishe, music. Later by J. P. Raymond.
 ::44 PAST AND PRESENT OF ALLAMAKEE COUNTY The fust
literary society of Waukon had its beginning in the college in 1862.
There were two. one for the boys and one for the girls. They met
once a week. A good many of the members then are members of
the Woman's Literary Society now. The foregoing history by Miss
Lewis was written in 1902. The public school superintendents who
have followed Mr. Dwelle are: J. H. Bowers. C. S. Cory (who, with C.
P. Colgrove, is now a member of the faculty of the Iowa State
Teachers' College), W. H. Ray and C. F. Pye, present incumbent. The
women who have taught are as worthy to be immortalized in this
history as the men already named; only their number and the
difficulty of obtaining their names for the earlier years makes it
impossible to present a full list. There are three names, however,
that ought to be mentioned with honor, for length of service. Miss
Lizzie Spaulding began teaching in 1881, and has taught here
continuously ever since. Misses Ida Thompson and Jessie Lewis
began several years earlier, but their service has not been
continuous. Miss Thompson retired several years ago ; the other two
are teaching yet, to the delight of many mothers of young children.
This school teaches the normal course for rural teachers, including
agriculture and domestic science. The number of teachers at
present, aside from the superintendent, is fourteen, as follows:
Principal. Miss Kleespie; mathematics, Miss McDougall; English and
history. Miss Stillman ; domestic science, Miss Clark; physics. Mr.
Salmonson ; music and drawing. Miss Harris; eighth grade, Miss
Carter; seventh, Miss Bock; sixth, Miss Westrum ; fifth, Miss Dial;
fourth, Miss Tench; third. Miss Lewis; second. Miss Spaulding; and
first, Miss Smith. Miss Smith is also a veteran, having taught here
twenty years; and Miss Dial not far short of that. We might add to
the early teachers mentioned by Miss Lewis the names of James
Bentley, George Butler and C. W. Walker, this writer receiving
instruction under each of them in the old schoolhouse, his home
being then in the same block, the present residence of A. M. May.
Mr. Bentley taught in 1860-1 ; Mr. Walker in the winter of 1862-3.
We have a distinct recollection of a correction the latter made in our
reading "The Village Blacksmith": "And the muscles of his brawny
arms were strong as iron bands," when we insisted in placing the
emphasis on the word "bands." Mr. Walker has resided in McGregor
since 1864, where he was for many years tickel agent for the river
packets and the Milwaukee railroad, and later mayor of the city
several terms. I le has retained his popularity among Waukon
people, and is still actively engaged in business at eighty-two years
young— so active' ami vigorous that the uninformed would not
suspect his true years. Mr. Bentley introduced a moot court, in which
he was the presiding judge, for the trial of petty infringements of
school rules. This proved rather an interesting diversion fur the
bright boys, and they soon began to provide so many cases thai the
time of the court was insufficient to try them all. and this' plan of
enforcing discipline was abandoned. The date of Mr. Bentley's
teaching is established by a cherished memento which we still
possess, in the' shape of a
 PAST AND PRESENT OF ALLAMAKEE COUNTY 345
pasteboard-and-ribbon rosette, bearing an inscription indicating
good scholarship and good behavior— but the latter statement
always caused the stirring of a guilty conscience. The "trophy" was
accompanied with a silver quarter, which we do not still possess. At
one time (think it was during Mr. Eastman's administration), a
flagrant case of insubordination by a grown up young man was
referred to the directors, who barred him from the school. As he
persisted in coming, however, it was decided to remove him forcibly
if need be. So three directors appeared one day, and upon his
refusing to go peaceably they surrounded him in his seat and after a
struggle succeeded in ejecting him from the building and locked the
door. He lingered around in that vicinity, like Mary's little lamb, and
when the directors had disappeared from view he coolly picked up a
stick of cordwood and with a gentle tap broke the lock and went in
to his accustomed seat. This narrator witnessed the performance
from the outside of the building, having escaped during the melee,
and cannot say what then occurred inside, but school was dismissed
very soon after. The final outcome is not now recalled. Private
schools were kept from time to time, and summer schools for the
little tots, in various places. We remember attending school in the
frame building on the north side of Main street, at the corner of
Armstrong, now owned and occupied as a dwelling by D. W.
Douglass. Also in the (later known as) Rankin store building on the
north side of Main street, which was destroyed by fire in 1878, later
occupied by other frame buildings which were torn down to make
room for the present D. J. Murphy brick block. Miss Pennoyer is
remembered as a popular teacher in some of these early schools.
The first school in Waukon was taught by L. O. Hatch, as stated by
Miss Lewis in her sketch, and we give the circumstances as we
obtained them from him, thirty years ago : "In the summer of 1854,
Mr. John Israel and myself united in buying from the county, at $15
each, four lots on the hill just east of the premises now owned by Dr.
Barnes. On these lots, in the fall of that year, with a little help from
Charley Jenkins, we built with our own hands a small, frame dwelling
house — the fourth frame building erected in Waukon. As winter
approached, we found ourselves with a school district duly
organized, embracing several families in and about Waukon, but no
schoolhouse and no teacher. Our house aforesaid being nearly
finished it was rented as a schoolhouse for the winter of 1854-5, and
I was employed as the teacher. I was paid $15 or $18 per month,
and 'boarded around' in the families of such men as Samuel Huestis,
Robert Isted, John A. Townsend, James Maxwell and others. I had
considerable experience as a teacher, but I was never in a school
made up of brighter or better pupils than those that gathered
around me on long, rude benches that winter, among whom I may
mention the names of those who later became Mrs. Hale, Mrs.
Adams, Mrs. judge Granger, Mrs. John Griffin ; and also Fred Clark
and Ichabod Isted." In 1855 the school district purchased the west
two-thirds of block 5, in Scott Shattuck's addition, and erected
thereon a substantial frame schoolhouse about 28x40 feet in size.
Win. Ramsdall and C. W. Jenkins being the builders. It was all in one
room except a hallway of about ten feet off the north end, with
outside doors in the middle and separate doors for the boys and girls
from the ball to the schoolroom, which was heated by an ordinary
box stove. At a later
 346 PAST AXJ) PRESENT OF ALLAMAKEE COUNTY day the
hallway was taken out and the entire room divided into two, with
entrance to each at the center on the west side. After this division,
we find in our boyhood diary, which noted only occasional events of
great importance, on April 4, 1864, school began, with .Miss Althea
Lottie teaching the higher department and Miss Clarissa Lyons the
other. Before this division the old school building served as a place
for public gatherings of all kinds for several years, until Hersey's hall
was finished. It was occupied by traveling panoramas, magic lantern
exhibitions, etc., and once or more did the county agricultural society
have its fair on the premises. Especially will the Iyceums be
remembered by the old residents, with the concerts by the old glee
club, and other interesting entertainments by home talent — to say
nothing of the singing schools. The earliest meetings of the religious
denominations were also held here, before they were able to erect
houses of worship. At one of the magic lantern shows we remember
the screen was placed by the traveling exhibitor well out toward the
middle of the room, and while the crowd was gathering he explained
that they could sit on either side, that "one side of the screen is just
as good as the other;" whereupon one of the big boys took the
liberty to stroll around and investigate, and remarked, "it aint either,
one side has a hole in it and t'other haint," which tickled us little
fellows immensely. In the fall of 1864 an arrangement was made
whereby Martin Stone was to teach the more advanced pupils of the
school, in the College building, which had passed into his hands, and
a similar arrangement was made the following year. In [866 he sold
the property to Thos. A. Cutler, who taught the school there the
following winter. In 1867 the district purchased the College property
of Cutler for $4,000, and afterwards sold the property in Shattuck's
addition to various parties. In 1881 the school building was improved
by putting in furnace, heating and ventilating apparatus. In the
spring of 1885 it was voted to erect a new school building, and F. M.
Ellis of Marshalltown was selected as the architect. Lender his plans
and specifications the following bids were submitted, the bidder to
have the old building: ( ieo. 1 1. King, of Brooklyn, Iowa, $13,345 ;
X. 1 1, l'ratt, $14,400 ; S. Peck & Sons, Sih,(x)o; E. B. Bascom,
$16,800. The contract was let to Mr. King, and the building was
occupied late the next fall. The board during this work comprised: I).
W. Reed, president; and directors, D. II. Bowen, H. O. Dayton. J. C.
Hubbell, F. II. Bobbins and W. C. Thompson. The great increase of
school population by 1895 made it necessary to provide much more
room and in the spring of 1896 an election was held on the question
of issuing S4.000 bonds to build an addition, which was carried by a
vote of 261 to j 1,?. the women voting on this proposition to the
number of 127. The alternative was to provide one or more
schoolhouses in other parts of town. The plans of architects C. G.
Mavbury & Son, of La Crosse, were adopted, the contract awarded
to Geo. 1'. Leefeldt. of McGregor, for $6,750, and the present north
wing was completed during that year. The board at this time
consisted of: A. T. Stillman, president; and directors, K. |. Alexander,
If. O. Dayton, |. E. Duffy, C. II. Earle and J. < ;. Ratcliffe. Mr.
Stillman has continued as president of the board ever since, or for
seven 
 PAST AND PRESENT OF ALLAMAKEE COUNTY 347 teen
years. The other directors at present are, R. J. Alexander, H. L.
Dayton, H. A. Howe and Frank Klees. We find no record of school
officers previous to 1859, in which year Moses Hancock was
president. C. J. White, vice president; A. G. Howard, secretary; and
W. K. McFarland. treasurer. November 8, 1862, the independent
district of Waukon was erected, comprising all of sub-district Xo. 8 in
Makee township: the south half of section 25, southeast quarter
section 26, northeart quarter section 35. and all of section 36 in
Union Prairie; and section 6 and west half section 5. in Jefferson
township. The first election of school officers in this independent
district was held November 29, 1862, resulting as follows : W. K.
McFarland, president ; E. B. Lyons, vice president; I. R. Brown,
secretary, and Jacob Shew, treasurer. Directors: J. B. Plank, "one
year; A. A. Griffith, two years (Mr. Griffith later a noted elocutionist
of Chicago,' died at Palmyra, Wisconsin, June 19, 1889), and J. W.
Pennington, three years. The independent district was formed with a
view to effect a transfer of the Allamakee college building to the
district, in which to establish a graded school, and in December a
committee was appointed to wait upon Professor Loughran with that
purpose. In February, 1863, a proposition of Professor Loughran was
rejected, and an attempt was made to secure the new courthouse,
then standing vacant. At the regular meeting, March 9th, D. W.
Adams was elected president ■ Moses Hancock, vice president; C.
W. Walker, secretary, and I. H. Hedge, treasurer. Since that year the
president and secretary of the board have been as follows :
President— A. I. Hersev. 1864-66; L. O. Hatch, 1866-7; Martin
Stone, 1867-9; C T. Granger, 1869-73; Tohn Goodykoontz, 1873-6;
A. L. Grippen, 1876; H. H. Stilwell 1876-9; M. Stone. 1879-80; T. W.
Pratt, 1880-1 ; John Hall, 1881-3; D. W. Reed. 1883-4; Martin Stone.
1884-5 ; D. W. Reed, 1885-9; H. H. Stilwell, 1889-90; D. H. Bowen,
1890-95; resigned November, '95, and H. O. Dayton to vacancv
1895-6; and A. T. Stillman. 1896-1913, present incumbent. Secretary
— Robert Isted. 1864-5; T. C. Ransom, 1865-7; C. T. Granger, 1867-
8; J. W. Pratt, 1868-74; A. J. Rodgers. 1874-82; E. M. Hancock.
1882-96; E D Purdy, 1896-1913, present incumbent. Treasurer— (
Since 1882)— L. W. Hersey, 1882-3; J. H. Boomer, 1883-4; L. W.
Hersey, 1884-5; 1. H. Boomer, 1885-8; L. W. Hersey, 1888-94; L. A.
Howe, 1894-1902; A. T. Nierling. 1802-06: W. H. Niehaus, 1906-10;
S. W. Ludeking. 1910-13, present incumbent. In 1908 it became
necessary to make improvements in the heating plant, and it was
decided to remove the old furnaces entirely and heat by steam.
Plans were adopted for a modern steam heating plant, with fan
system of ventilation, and automatic regulation. Bids were advertised
for. March 2d, and examined May 20th. as follows: Lewis & Kitchen.
$7,500: Thill & Laptz. $8,717; I. E. Beeman. $9,278; Peter Johnson
& Son, $11,266.65. The contract was awarded to Lewis & Kitchen,
lowest bidders, and plant installed during the summer vacation. The
present value of the school building and contents is considered to be
$40,000. In 1863 the number of school age in the district was 307 In
1882 the number of school age in the district was 472
 348 PAST AND PRESENT OF ALLAMAKEE COUNTY In 1895
the number of school age in the district was 678 In 1898 the
number of school age in the district was 725 In 1912 the number of
school age in the district was 622 (Males 317; females. 305.) Present
enrollment is about 400. The first class to graduate from the high
school was in 1879, and consisted of Misses Minnie C. Earle, Jessie
M. Lewis. Lizzie W. Spaulding and Lizzie G. Ward. The total number
of graduates is now 330. including the eleven of 1913., About the
year 1894, or '95 the remnant of the old Waukon Library, which was
started in the early sixties by the Waukon Dramatic Club, as the
result of a series of delightful entertainments by home talent — and
talent it was, of the first order — was turned over to the care of the
school, as a nucleus for a school library, which now possesses some
1,800 volumes. When the old library was established the books were
kept for years at the home of D. W. Adams, and comprised a most
excellent and varied selection. I^ter the library was housed in other
homes, and was for some time kept up by the Young Men's
Temperance Association, by whom it was finally transferred to the
school. ALLAMAKEE COLLEGE While of brief existence, this
institution is worthy of mention as contributing to the ancient history
of this town and county. Its conception was in 1859, when on the
6th of March, J. C. Armstrong, J. B. Plank, C. J. White, Walter
Delafield, M. G. Belden, R. C. Armstrong, James Maxwell, Jacob
Shew, Benj. H. Bailey, Joseph Savoie. T. J. Goodykoontz, William S.
Cook, John Chapman and Lewis H. Clark, associated themselves
together in a corporation to be known as the "Allamakee
Association," to be under the supervision of the Colesburg
Presbytery of the Cumberland Presbyterian church, for the purpose
of erecting suitable buildings for the advancement of scientific and
religious learning, to be known as the Waukon Seminary. Out of this
grew the Allamakee College, a catalogue of which was printed in
[862, from which we gather its history, in substance, as follows : A
number of citizens of Waukon and vicinity, deeply feeling the want in
their rapidly growing community of an institution of learning of an
academic or collegiate order, entered into an agreement with Rev. J.
Loughran, A. M., formerly president of Waynesburg College.
Pennsylvania, for the erection in Waukon of a suitable college
edifice, and the maintenance therein of a school as above named,
on the following plan: They stipulated to draw in favor of said J.
Loughran their promissory notes, each for $125, to be paid within
one year from date, fur which they should receive from him
certificates of scholarship, each scholarship guaranteeing the tuition
of one student for five years in the institution, to eminence when the
building would be finished. At the end of the five years the title of
the property was to pass to Mr. Loughran in full ownership, being
paid for by said scholarships. To carry out this plan the following
gentlemen were chosen by the stockholders with the style and title
of "Trustees of Allamakee College :" R C Arm 
The text on this page is estimated to be only 9.00%
accurate

' '.■■:■ f^\-' '':~\ '■'' W?'^'"' !.iV RESIDENCE OF 0. J.

HAGER. WAUKOX
 PAST AND PRESENT OF ALLAMAKEE COUNTY 351 strong,
Robert Isted, Walter Delafield, A. M. Haslip, L. G. Calkins, A. H.
Hersey, W. R. Pottle, Jacob Shew and Jacob Plank. Walter Delafield
donated the whole of block 19 in his addition to Waukon, comprising
two acres, as a site for the building. The notes given by the
stockholders were transferred by Mr. Loughran to the trustees, and
with the money accruing they erected a three-story brick edifice, in
size 47 by 64 feet, the height of the stories being 11, 13 and 8^2
feet, respectively. Its accommodations were, four large recitation
rooms on the first floor, a hall in the second story 44 by 52 feet, and
eight rooms in the third story, each 13 by 19 feet, designed for
students desiring to board themselves. This was built in 1861,
following the completion of the courthouse, but was not finished for
occupancy until the following spring. In the fall of 1862 there were
ninety students in attendance, double the number entitled to tuition
on scholarships, that being but forty-eight. The announcement in the
catalogue goes on to say : "The trustees have manifested a most
praiseworthy liberality and perseverence. They have raised and
almost completed the building in the face of the greatest money
pressure ever experienced in the West. The institution is now in
successful operation. One hundred and twenty-five students have
been in attendance during the past year, and over, three hundred
since the commencement of the school in 1859. But this summer is
the first we have occupied the college building. The scholarships
became available when we entered the building." Rev. J. Loughran,
president, resided in the building with his family. He was ably
assisted during the first three years by the following faculty : J. C.
Loughran, higher academic. G. H. Brock, higher academic. (Enlisted
in Co. B, 12th Iowa Infantry, October 7, 1861.) W. W. Likens,
collegiate scientific. Mrs. Jennie Calkins, French, German and
mathematics. Mrs. Jennie Loughran, lower academic. Miss Pennoyer,
lower academic and professor of phonography and phonetic
shorthand. Professor Loughran had opened what was called the
Waukon High School, October 3, 1859, in the Presbyterian church,
and conducted the same successfully for three years or until the
college building was completed, with the above named assistants,
and Prof. A. A. Griffith in elocution. Mr. Loughran was pretty
thorough, both in instruction and in discipline, believing in the
virtues of the old-fashioned switch. The timid ones among the pupils
however dreaded the expression of his displeasure, as worse than a
licking. In his catalogue he says : "We do not use the topic system
as it often tends to strengthen the memory at the expense of the
reasoning faculties. We require our students to analyze each lesson,
and where it can be done, to explain fully the rationale of the
process on the black-board. Where the black-board cannot be used,
they must give the analysis verbally or in writing. During the
recitation they are not allowed the use of books. * * * The object is
to draw them out, to interest them in the subject of the lesson, and
to excite them to depend as much as possible upon their own
reason." All of which is doctrine too often neglected at this day. The
institution was deserving of success, but unfortunately it was not
such as hoped for; probably the absence of so many young men
during that time in
 352 PAST AND PRESENT OP ALLAMAKEE COUNTY the war
was one of the causes ; and in May, 1863, a corporation styled the
"Allamakee Collegiate Institute" was formed for the purpose of
cancelling the indebtedness against the Allamakee College and
perpetuating the institution. In the same year the property was
purchased by Martin Stone, and a few years later passed into the
possession of the Independent School District of Waukon, as
described elsewhere. It would be interesting to print here the names
of all enrolled as shown by this old catalogue, but the list is too long.
But the list of those still living here ( all or part of the time ) is very
brief : Year 1859-60 — Ellen Hedge, Althea Pottle, John P. Raymond,
collegiate, Mary Stillman, Martha Shaw, DeEtte Clark, Emery Pratt,
George Schrody, Samuel Thompson, Herbert Townsend, Nelson
Maxwell, Perky Raymond, academic. Year t86o-6i — (Omitting
repetitions) Phoebe Maxwell, Henry Bentley, collegiate; Emma
Townsend, Mary Johnson, Bert Taggart, George Johnson, Ellery
Hancock, academic. Year 1861-62 — (Omitting repetitions) Eva
MeClaskey, academic. In July, 1876, after closing his contract with
the Waukon public school, Professor Loughran bought the old
German Presbyterian church building and removed it to his premises
on Worcester street, where in September following he opened an
institution of learning called the Waukon Seminary, well supplied
with maps, charts, chemical and philosophical apparatus, and more
especially for the purpose of preparing students for teaching, or for
a college course. Professor Loughran had devoted a long and active
life to the interests of education, and was exceedingly well qualified
for instructing in the higher branches. His seminary continued to
flourish for several years, until in 1883 it was discontinued, and Mr.
Loughran removed to White Lake, South Dakota, to the regret of
hosts of his old Waukon friends, where be died in or about the year
1900 at a ripe old age. THE PRESS 'I he Wawkon Journal, the first
newspaper published here, was established by Frank Belfoy in the
spring of 1857, and was free-soil in politics. It was first printed in the
Taggart building, situated on the northeast corner of .Main and
Armstrong streets, which is still standing, the residence of D. W.
Douglass. This lot. being lot 4 in block 2, Armstrong's addition, was
purchased of Armstrong in 1856, for $25, by Mr. John A. Taggart,
who built the house thereon. After some nine months Belfoy sold the
paper to Frank Pease, who made a democratic sheet of it and
changed the name to Allamakee Herald, the first number of which
was issued February 26, 1858. It was a six-column folio, issued
Fridays; and one M. M. Webster, a lawyer, was associated with Pease
for a while, as was also R. K. Smith, who afterwards went south and
his fate is unknown, lie was a brother of James C. Smith, a pioneer
of Yolnev. later a hotel man in Waukon and Decorah, and at the time
of his death, in 1875, owner of the part of Waukon where is now
Ratclift'e's addition. The Herald was discontinued 111 May. iS^, and
Pease drifted southward, continuing in newspaper work; but in 1S7S,
when lasl heard of, he was city clerk of Hot Springs, Arkansa-.
Welcome to our website – the ideal destination for book lovers and
knowledge seekers. With a mission to inspire endlessly, we offer a
vast collection of books, ranging from classic literary works to
specialized publications, self-development books, and children's
literature. Each book is a new journey of discovery, expanding
knowledge and enriching the soul of the reade

Our website is not just a platform for buying books, but a bridge
connecting readers to the timeless values of culture and wisdom. With
an elegant, user-friendly interface and an intelligent search system,
we are committed to providing a quick and convenient shopping
experience. Additionally, our special promotions and home delivery
services ensure that you save time and fully enjoy the joy of reading.

Let us accompany you on the journey of exploring knowledge and

personal growth!

ebookfinal.com