Mobile Information Systems / 2017 / Article / Tab 7

Research Article

An Enhancement of Optimized Detection Rule of Security Monitoring and Control for Detection of Cyberthreat in Location-Based Mobile System

Table 7

Optimization of Payload Detection (Content, Content Modifier) Rules.

Command formatSelection of detection rule standardization

Payload DetectioncontentSpecific content to look for in the payload of a packet
nocaseCase insensitive
rawbytesIgnore the decoding process and check raw packet data
offsetPattern search start position (after the first few bytes of the packet)
depthPattern search range (compare pattern search from offset to several bytes)
distanceNew pattern search start position after a previous pattern match (after a few bytes)
withinPattern search range (compare pattern search from distance to several bytes)

Command formatExcluded detection rules standardized/excluded reasons

Payload Detectionhttp_client_bodySearch in body part of HTTP request Except for the content option
http_cookieSearch in the cookie portion of the HTTP header
http_headerSearch in the HTTP header section
http_methodSearch in the HTTP methods section
http_uriSearch in the HTTP URI section
fast_patternSpecify the pattern to search firstExcluded as string matching from specified priority

Article of the Year Award: Outstanding research contributions of 2020, as selected by our Chief Editors. Read the winning articles.