Distributed evasive scan techniques and countermeasures

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

Volumn 4579 LNCS, Issue , 2007, Pages 157-174

  Min, Gyung Kang ^a   Caballero, Juan ^a   Dawn, Song ^a  

^a CARNEGIE MELLON UNIVERSITY   (United States)

Author keywords

Distributed scanning; Evasion; Information hiding; Scan detection

Indexed keywords

DISTRIBUTED SCANNING; INFORMATION-HIDING; SCAN DETECTION;

CLASSIFICATION (OF INFORMATION); COMPUTER SIMULATION; DISTRIBUTED COMPUTER SYSTEMS; INFORMATION RETRIEVAL;

SECURITY OF DATA;

EID: 37849009761     PISSN: 03029743     EISSN: 16113349     Source Type: Book Series    
DOI: None     Document Type: Conference Paper

References (23)

1. antirez. IP ID reverse scan, http://www.kyuzz.org/antirez/papers/ dumbscan.html
2. Fyodor. The Art of Port Scanning. Phrack 51, vol. 7 (September 1, 1997), http://www.phrack.com/phrack/51/P51-11
3. hybrid Distributed information gathering. Phrack 51, vol. 9 (September 9, 1999) http://www.phrack.org/phrack/55/P55-09
4. Morph, http://www.synacklabs.net/projects/morph/
5. Snot, http://www.10t3k.org/security/tools/ids/
6. Stick, http://www.10t3k.org/security/tools/ids/
7. Antonatos, S., Akritidis, P., Markatos, E., Anagnostakis, K.G.: Defending against Hitlist Worms using Network Address Space Randomization. In: ACM Workshop on Rapid Malcode (Fairfax, VA, USA, 11 (November 2005)
8. Basu, R., Cunningham, R.K., Lippmann, R.P.: Detecting Low-Profile Probes and Novel Denial-of-Service Attacks. In: Proceedings 2nd Annual IEEE Systems, Man, and Cybernetics Information Assurance Workshop (West Point, NY, USA) (June 5-6, 2001)
9. Crosby, S., Wallach, D.: Denial of Service via Algorithmic Complexity Attacks. In: Proceedings of the 12th USENIX Security Symposium (Washington DC, USA) (August 4-8, 2003)
10. Dreger, H., Feldmann, A., Paxson, V., Sommer, R.: Operational Experiences with High Volume Network Intrusion Detection. In: 11th ACM Conference on Computer and Communications Security, Washington DC, USA, October 25-29, 2004, ACM Press, New York (2004)
11. Heberlein, L.T., Dias, G.V., Levitt, K.N., Mukherjee, B., Wood, J., Wolber, D.: A network security monitor. In: Proceedings of the IEEE Symposium on Research in Security and Privacy
12. Jung, J., Paxson, V., Berger, A.W., Balakrishnan, H.: Fast Portscan Detection Using Sequential Hypothesis Testing. In: IEEE Symposium on Security and Privacy, Berkeley/Oakland, CA, USA, May 9-12, 2004, IEEE Computer Society Press, Los Alamitos (2004)
13. Kato, N., Nitou, H., Ohta, K., Mansfield, G., Nemoto, Y.: A Real-Time Intrusion Detection System(IDS) for Large Scale Networks and its Evaluations. IEICE Transactions on Communication E82B(11), 1817-1825
14. Kreibich, C., Crowcroft, J.: Honeycomb -Creating Intrusion Detection Signatures Using Honeypots. In: 2nd Workshop on Hot Topics in Networks Boston, MA, USA (November 20-21, 2003)
15. Leckie, C., Kotagiri, R.: A Probabilistic Approach to Detecting Network Scans. In: Proceedings of the Eighth IEEE Network Operations and Management Symposium. Florence, Italy (April 15-19, 2002)
16. Paxson, V.: Bro: a system for detecting network intruders in real-time. Computer Networks (Amsterdam, Netherlands) 31(23-24), 2435-2463 (1999)
17. Provos, N.: A Virtual Honeypot Framework. In: Proceedings of the 13th USENIX Security Symposium San Diego, CA, USA (August 9-13, 2004)
18. Ptacek, T.H., Newsham, T.N.: Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection. Technical report
19. Robertson, S., Siegel, E.V., Miller, M., Stolfo, S.J.: Surveillance Detection in High Band-width Environments. In: Proceedings of the 2003 DARPA DISCEX III Conference Washington DC, USA (April 22-24, 2003)
20. Roesch, M.: Snort-Lightweight Intrusion Detection for Networks. In: Proceedings of LISA'99: 13th Systems Administration Conference Seattle, WA, USA (November 7-12, 1999)
21. Schechter, S.E., Jung, J., Berger, A.W.: Fast Detection of Scanning Worm Infections. 7th International Symposium on Recent Advances in Intrusion Detection Sophia Antipolis, French Riviera, France (September 15-17, 2004)
22. Staniford, S., Hoagland, J.A., McAlerney, J.M.: Practical Automated Detection of Stealthy Portscans. In: Proceedings of the 7th ACM Conference on Computer and Communications Security. Athens, Greece (November 1-4, 2000)
23. Weaver, N., Staniford, S., Paxson, V.: Very Fast Containment of Scanning Worms. In: 13th USENIX Security Symposium. San Diego, CA, USA (August 9-13, 2004)