Detecting evasion attacks at high speeds without reassembly

Computer Communication Review

Volumn 36, Issue 4, 2006, Pages 327-338

  Varghese, George ^a   Andrew Fingerhut, J ^b   Bonomi, Flavio ^b  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b CISCO SYSTEMS   (United States)

Author keywords

Evasion attacks; Normalization; TCP reassembly

Indexed keywords

EVASION ATTACKS; INTRUSION PREVENTION SYSTEMS (IPS); NORMALIZATION; TCP REASSEMBLY;

COMPUTER CRIME; COST ACCOUNTING; DATA PROCESSING; PACKET NETWORKS; ROUTERS; SECURITY SYSTEMS;

DEMODULATION;

EID: 33750316215     PISSN: 01464833     EISSN: 01464833     Source Type: Conference Proceeding    
DOI: 10.1145/1151659.1159951     Document Type: Conference Paper

References (17)

1. Alfred V. Aho and Margaret J. Corasick. "Efficient string matching: An aid to bibliographic search." Communications of the ACM 18(6):333-340, June 1975.
2. N. Alon, Y. Matias, and M. Szegedy. "The space complexity of approximating the frequency moments". Proceedings 28th ACM Symp. on Theory of Computing, pages 20-29, May 1996.
3. G. Appenzeller, I. Keslassy, and N. McKeown "Sizing Router Buffers". Proceedings of ACM SIGCOMM, 2004.
4. D. Clark, "The Structuring of Systems Using Upcalls". Proceedings of the 10th ACM Symposium on Operating Systems Principles, pp. 171-180, December 1-4 1985.
5. S. Dharmapurikar, P. Krishnamurthy, T. Sproull, and J. W. Lockwood, "Deep packet inspection using parallel Bloom filters. Hot Interconnects, Aug. 2003.
6. S. Dharmapurikar, V. Paxson, "Robust TCP stream reassembly in the presence of adversaries". Proceedings of the 14th USENIXSecurity Symposium, Baltimore, 2005.
7. "The Future of the Internet". Red Herring, April 10th, 2006.
8. M. Handley, C. Kreibich, and V. Paxson. "Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics". Proc. USENIX Security Symposium, May 2001.
9. K. Levchenko, R. Paturi, and G. Varghese. "On the Difficulty of Scalably Detecting Network Attacks". Proc. of the Eleventh ACM Conference on Computer and Communication Security, October 2004.
10. Nikto, http://www.cirt.net/code/nikto.shtml
11. NSS Group. Intrusion Prevention Systems (IPS) Group Test (Edition 3), NSS Group, August 2005, http://www.nss.co.uk
12. V. Paxson, "Bro: A System for Detecting Network Intruders in Real-Time". Computer Networks, 31(23-24), pp. 2435-2463, 14 Dec 1999
13. V. Paxson and M. Handley, "Defending Against NIDS Evasion using Traffic Normalizers". Second International Workshop on the Recent Advances in Intrusion Detection, September 1999.
14. T. Ptacek and T. Newsham. "Insertion, Evasion and Denial of Service: Eluding Network Intrusion Detection", Secure Networks, Inc., Jan. 1998.
15. M. Roesch, "Snort - Lightweight Intrusion Detection for Networks", LISA 99.
16. C. Shannon, D. Moore, k. claffy, "Characteristics of Fragmented IP Traffic on Internet Links", Workshop on Passive and Active Measurement, 2001.
17. Dug Song, 2002, Fragroute, http://www.monkey.org/dugsong/fragroute/