Active mapping: Resisting NIDS evasion without altering traffic

Proceedings - IEEE Symposium on Security and Privacy

Volumn 2003-January, Issue , 2003, Pages 44-61

  Shankar, U ^a   Paxson, V ^b  

^a UNIVERSITY OF CALIFORNIA   (United States)

^b LAWRENCE BERKELEY NATIONAL LABORATORY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

INTRUSION DETECTION; NETWORK ARCHITECTURE; SEMANTICS;

CRITICAL PROBLEMS; NETWORK INTRUSION DETECTION SYSTEMS; NETWORK TOPOLOGY; NETWORK TRAFFIC; PERFORMANCE PROBLEMS; PROTOTYPE IMPLEMENTATIONS; REAL-WORLD TESTS; TRAFFIC STREAMS;

MAPPING;

EID: 84899126047     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SECPRI.2003.1199327     Document Type: Conference Paper

References (20)

1. Steven M. Bellovin, "A Technique for Counting NATted Hosts." Proceedings of the Second Internet Measurement Workshop, November 2002.
2. S. Blake et al, "An Architecture for Differentiated Services," RFC 2475, Dec. 1998.
3. R. Droms et al., "Dynamic Host Configuration Protocol," RFC 2131, Mar. 1997.
4. L. Deri and S. Suin, "Improving Network Security Using Ntop," Proc. Third International Workshop on the Recent Advances in Intrusion Detection (RAID 2000), 2000.
5. K. Egevang and P. Francis, "The IP Network Address Translator (NAT)," RFC 1631, 1994.
6. Fyodor. nmap, 2001. http://www.insecure.org/nmap/.
7. Mark Handley, Christian Kreibich and Vern Paxson, "Network Intrusion Detection: Evasion, Traffic Normalization," Proc. 10th USENIX Security Symposium, 2001.
8. John McDonald. "Defeating Sniffers and Intrusion Detection Systems," Phrack Magazine, 8(54), Dec 25th, 1998.
9. S. McCanne, C. Leres and V. Jacobson, libpcap, available at http://www.tcpdump.org, 1994.
10. Vern Paxson, "Bro: A System for Detecting Network Intruders in Real-Time," Computer Networks, 31(23-24), pp. 2435-2463, 14 Dec. 1999.
11. Jitendra Padhye and Sally Floyd, "Identifying the TCP Behavior of Web Servers," Proc. ACM SIGCOMM, Aug. 2001.
12. T. H. Ptacek and T. N. Newsham, "Insertion, Evasion and Denial of Service: Eluding Network Intrusion Detection", Secure Networks, Inc., Jan. 1998. http://www.icir.org/vern/Ptacek-Newsham-Evasion-98.ps
13. J. Postel, "User Datagram Protocol," RFC 768, August 1980.
14. J. Postel, "Internet Protocol," RFC 791, September 1981.
15. J. Postel, "Internet Control Message Protocol," RFC 792, September 1981.
16. J. Postel, "Transmission Control Protocol," RFC 793, September 1981.
17. Savage, "QueSO," savage@apostols.org, 1998. http://www.backupcentral.com/cgibin/redirect?url=ftp://contrib.redhat.com/pub/contrib/libc6/SRPMS/queso-980922b-1.src.rpm.
18. Dug Song, fragroute. Available at http://www.monkey.org/~dugsong/fragroute/.
19. Gary R. Wright and W. Richard Stevens, TCP/IP Illustrated: The Implementation, Addison-Wesley, 1995.
20. T. Ylonen et al, "SSH Transport Layer Protocol," Internet Draft, work in progress, 2002.