A functional framework to evade network IDS

Proceedings of the Annual Hawaii International Conference on System Sciences

Volumn , Issue , 2011, Pages

  Pastrana, Sergio ^a   Orfila, Agustin ^a   Ribagorda, Arturo ^a  

^a UNIVERSIDAD CARLOS III DE MADRID   (Spain)

Author keywords

[No Author keywords available]

Indexed keywords

DATA SETS; NETWORK IDS; NETWORK SEGMENT; PROOF OF CONCEPT; SET OF RULES; SIGNATURE-BASED NETWORK INTRUSION DETECTION SYSTEMS;

GENETIC PROGRAMMING; NETWORK PROTOCOLS; PERSONAL COMPUTING; SYSTEMS SCIENCE;

INTRUSION DETECTION;

EID: 79952917584     PISSN: 15301605     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/HICSS.2011.12     Document Type: Conference Paper

References (30)

1. R. Bace and P. Mell, "NIST Special Publication on Intrusion Detection Systems", 800-31, 2001
2. T. H. Ptacek and T. N. Newsham, "Insertion, evasion and denial of service: Eluding network intrusion detection," Technical report, 1998.
3. J. R. Koza, "Genetic Programming: On the Programming of Computers", M. Press, Ed.Cambridge, MA, USA, 1992.
4. S. Pastrana, A. Orfila, and A. Ribagorda, "Modeling NIDS evasion with Genetic Programming", on the Proceedings of The 2010 International Conference on Security and Management, SAM 2010, Las Vegas, Nevada, USA, July 11-15, 2010
5. D. Son. (2002) Fragroute. [Online]. http://www.monkey.org/~dugsong/ fragroute/
6. L. Juan, C. Kreibich, C.-H. Lin, and V. Paxson, "A Tool for Offline and Live Testing of Evasion Resilience in Network Intrusion Detection Systems," in DIMVA '08: Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment, Paris, France, 2008, pp. 267-278.
7. D. Watson, M. Smart, R. G. Malan, and F. Jahanian, "Protocol scrubbing: network security through transparent flow modification," IEEE/ACM Transactions on Networking, vol. 12, pp. 261-273, 2004.
8. M. Handley, C. Kreibich, and V. Paxson, "Network instrusion detection: Evasion, traffic normalization and end-to-end protocol semantics," in Proceedings of the 10th Conference on USENIX Security Symposium-Volume 10, 2001, p. 9.
9. M. Vutukuru, H. Balakrishnan, and V. Paxson, "Efficient and Robust TCP Stream Normalization," in SP '08: Proceedings of the 2008 IEEE Symposium on Security and Privacy, Washington, DC, USA, 2008, pp. 96-110.
10. G. Varghese, J. A. Fingerhut, and F. Bonomi, "Detecting evasion attacks at high speeds without reassembly," in SIGCOMM '06: Proceedings of the 2006 conference on Applications, technologies, architectures, and protocols for computer communications, Pisa, Italy, 2006, pp. 327-338.
11. U. Shankar and V. Paxson, "Active Mapping: Resisting NIDS Evasion without Altering Traffic," in SP '03: Proceedings of the 2003 IEEE Symposium on Security and Privacy, Washington, DC, USA, 2003, p. 44.
12. M. Roesch, "Snort - Lightweight Intrusion Detection for Networks," in LISA '99: Proceedings of the 13th USENIX conference on System administration, Seattle, Washington, 1999, pp. 229-238.
13. G. Antichi, D. Ficara, S. Giordano, G. Procissi, and F. Vitucci, "Counting Bloom Filters for Pattern Matching and Anti-Evasion at the Wire Speed," IEEE Network Magazine of Global Internetworking, vol. 23, no. 1, pp. 30-35, 2009.
14. D. Mutz, C. Kruegel, W. Robertson, G. Vigna, and R. A. Kemmerer "Reverse Engineering of Network Signatures", in Proceedings of the AusCERT Asia Pacific Information Technology Security Conference, Gold, 2005
15. A. Orfila, J. M. Estevez-Tapiador, and A. Ribagorda, "Evolving High-Speed, Easy-to-Understand Network Intrusion Detection Rules with Genetic Programming," in EvoWorkshops '09: Proceedings of the EvoWorkshops 2009 on Applications of Evolutionary Computing, Tübingen, Germany, 2009, pp. 93-98.
16. J. Blasco, A. Orfila, and A. Ribagorda, "Improving Network Intrusion Detection by Means of Domain-Aware Genetic Programming," in , Krakow, Poland, 2010.
17. G. Folino, C. Pizzuti, and G. Spezzano, "GP Ensemble for Distributed Intrusion Detection Systems," in ICAPR, 2005, pp. 54-62.
18. S. Mukkamala, A. Sung, and A. Abrham, "Modeling intrusion detection systems using linear genetic programming approach," in IEA/AIE'2004: Proceedings of the 17th international conference on Innovations in applied artificial intelligence, Ottawa, 2004, pp. 633-642.
19. S. Peddabachigari, A. Ajith, C. Grosan, and J. Thomas, "Modeling intrusion detection system using hybrid intelligent systems," Journal in Network Computer Applications, vol. 30, no. 1, pp. 114-132, 2007.
20. M. Crosbie and E. Spafford, "Applying Genetic Programming to Intrusion Detection," in Working Notes for the AAAI Symposium on Genetic Programming, 1995, pp. 1-8.
21. R. Kohavi, "A Study of Cross-Validation and Bootstrap for Accuracy Estimation and Model Selection", in IJCAI: International Joint Conference on Artificial Intelligence, Volume 2, Issue 1, 1137-1143, 1995
22. J.R. Quinlan, "C4.5: Programs for Machine Learning (Morgan Kaufmann Series in Machine Learning)", Morgan Kaufmann, 1993
23. Lawrence Berkley National Laboratory and ICSI. (2005) LBNL/ICSI Enterprise Tracing Project. [Online]. www.icir.org/entreprise-tracing/
24. S. Hettich and S. Bay. (1999) The UCI KDD Archive. [Online]. http://kdd.ics.uci.edu
25. I. Fraf, R. Lippmann, R. Cunningham, D. Fried, J. Kendall, S. Webster, and M. Zissman, "Results of DARPA 1998 offline intrusion detection evaluation", 1998, DARPPA PI Meeting, Cambridge, Massachusetts, USA.
26. W. Lee and S.J. Stolfo. "A framework for constructing features and models for intrusion detection systems", ACM Transactions on Information and System Security, vol. 3, no. 4, pp 227-261, 2000
27. A.C. Smith and K. Kendall Thesis, "A Database of Computer Attacks for the Evaluation of Intrusion Detection Systems", in Proceedings DARPA Information Survivability Conference and Exposition (DISCEX), 1999, 12-26
28. M. Hall, E. Frank, G. Holmes, B. Pfahringer, P. Reutemann, I. H. Witten, "The WEKA Data Mining Software: An Update", in SIGKDD Explorations, Volume 11, Issue 1,2009
29. N. Friedman, D. Geiger, M. Goldszmidt, "Bayesian Network Classifiers", Machine Learning, vol. 29, issue 2, pp 131-163, 1997
30. Nmap. [Online]. HYPERLINK "http://nmap.org/"