Active mapping: Resisting NIDS evasion without altering traffic

Proceedings of the IEEE Computer Society Symposium on Research in Security and Privacy

Volumn , Issue , 2003, Pages 44-58

  Shankar, Umesh ^a   Paxson, Vern ^b  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b LAWRENCE BERKELEY NATIONAL LABORATORY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

COMPUTER CRIME; COMPUTER SYSTEM FIREWALLS; DATABASE SYSTEMS; INTERNET; NETWORK PROTOCOLS; REAL TIME SYSTEMS; SECURITY OF DATA; SEMANTICS; TELECOMMUNICATION TRAFFIC;

NETWORK INTRUSION DETECTION SYSTEM; NETWORK TRAFFIC; SOFTWARE PACKAGE ACTIVE MAPPING;

SOFTWARE PROTOTYPING;

EID: 0038825042     PISSN: 10637109     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (20)

1. Steven M. Bellovin, "A Technique for Counting NATted Hosts." Proceedings of the Second Internet Measurement Workshop, November 2002.
2. S. Blake et al, "An Architecture for Differentiated Services," RFC 2475, Dec. 1998.
3. R. Droms et al., "Dynamic Host Configuration Protocol," RFC 2131, Mar. 1997.
4. L. Deri and S. Suin, "Improving Network Security Using Ntop," Proc. Third International Workshop on the Recent Advances in Intrusion Detection (RAID 2000), 2000.
5. K. Egevang and P. Francis, "The IP Network Address Translator (NAT)," RFC 1631, 1994.
6. Fyodor nmap, 2001. http://www.insecure.org/nmap/.
7. Mark Handley, Christian Kreibich and Vern Paxson, "Network Intrusion Detection: Evasion, Traffic Normalization," Proc. 10th USENIX Security Symposium, 2001.
8. John McDonald, "Defeating Sniffers and Intrusion Detection Systems," Phrack Magazine, 8(54), Dec 25th, 1998.
9. S. McCanne, C. Leres and V. Jacobson, libpcap, available at http://www.tcpdump.org, 1994.
10. Vern Paxson, "Bro: A System for Detecting Network Intruders in Real-Time," Computer Networks, 31(23-24), pp. 2435-2463, 14 Dec. 1999.
11. Jitendra Padhye and Sally Floyd, "Identifying the TCP Behavior of Web Servers," Proc. ACM SIGCOMM, Aug. 2001.
12. T. H. Ptacek and T. N. Newsham, "Insertion, Evasion and Denial of Service: Eluding Network Intrusion Detection", Secure Networks, Inc., Jan. 1998. http://www.icir.org/vern/Ptacek-Newsham-Evasion-98.ps
13. J. Postel, "User Datagram Protocol," RFC 768, August 1980.
14. J. Postel, "Internet Protocol," RFC 791, September 1981.
15. J. Postel, "Internet Control Message Protocol," RFC 792, September 1981.
16. J. Postel, "Transmission Control Protocol," RFC 793, September 1981.
17. Savage, "QueSO," savage@apostols.org, 1998. http://www.backupcentral.com/cgibin/redirect?url=ftp://contrib.redhat.com/pub/co ntrib/libc6/SRPMS/queso-980922b-1.src.rpm.
18. Dug Song, fragroute. Available at http://www.monkey.org/~dugsong/fragroute/.
19. Gary R. Wright and W. Richard Stevens, TCP/IP Illustrated: The Implementation, Addison-Wesley 1995.
20. T. Ylonen et al, "SSH Transport Layer Protocol," Internet Draft, work in progress, 2002.