Real-Time Protocol Analysis for Detecting Link-State Routing Protocol Attacks

ACM Transactions on Information and System Security

Volumn 4, Issue 1, 2001, Pages 1-36

  Chang, Ho Yen ^a   Wu, S Felix ^b   Jou, Y Frank ^c  

^a Ericsson IP Infrastructure   (United States)

^b UNIVERSITY OF CALIFORNIA   (United States)

^c MCNC   (United States)

Author keywords

Design; Event correlation; Knowledge Based IDS; Link State routing protocol security; OSPF attacks; Real Time misuse intrusion detection; Real Time network protocol analysis; Security; Theory; Timed finite state machine

Indexed keywords

EID: 85017067350     PISSN: 10949224     EISSN: 15577406     Source Type: Journal    
DOI: 10.1145/383775.383776     Document Type: Article

References (36)

1. Alur, R. 1998. Timed automata. http://www.cis.upenn.edu/alur/onlinepub.html.
2. Alur, R. and Dill, D. L. 1994. A theory of timed automata. Theor. Comput. Sci. 126, 2 (Apr. 25), 183-235.
3. Anderson, D., Frivold, T., and Valde, A. 1995. Next generation intrusion detection expert system (NIDES): A summary. Tech. Rep. Computer Science Laboratory, SRI International, Menlo Park, CA. http://www2.csl.sri.com/nides/index5.html.
4. Bradley, K. A., Cheung, S., Puketza, N., Mukherjee, B., and Olsson, O. 1998. Detecting disruptive routers: A distributed network monitoring approach. In Proceedings of the 1998 IEEE Symposium on Computer Security and Privacy (Oakland, CA, May). IEEE Computer Society Press, Los Alamitos, CA. http://seclab.cs.ucdavis.edu/cheung.
5. Cannady, J. and Harrell, J. 1996. A comparative analysis of current intrusion detection technologies. In Proceedings of the Fourth Conference on Technology for Information Security (ISC'96, May).
6. Chang, H., Jou, Y., and Wu, S. 1998. Real-time protocol analysis for link-state routing. Tech. Rep. CDRL A007. Computer Science Department, NC State, Raleigh, NC.
7. Debar, H., Dacier, M., and Wespi, A. 1998. Towards a taxonomy of intrusion-detection systems. Tech. Rep. IBM Zurich Laboratory, Zurich, Switzerland. http://domino.watson.ibm.com/library/cyberdig.nsf/.
8. Denning, D. E. 1987. An intrusion-detection model. IEEE Trans. Softw. Eng. SE-13, 2 (Feb.), 222-232.
9. D'haeseleer, P., Forrest, S., and Helman, P. 1996. An immunological approach to change detection: Algorithms, analysis, and implications. In Proceedings of the IEEE Symposium on Security and Privacy (Oakland, CA, May). IEEE Press, Piscataway, NJ.
10. Dijkstra, E. W. 1974. Self-stabilizing systems in spite of distributed control. Commun. ACM 17, 11, 643-644.
11. Frank, J. 1994. Artificial intelligence and intrusion detection: Current and future directions. In Proceedings of the 17th National Conference on Computer Security (oct.). http://seclab.cs.ucdavis.edu/papers.html.
12. Garvey, T. and Lunt, T. F. 1991. Model-based intrusion detection. In Proceedings of the 14th NIST-NCSC National Conference on Computer Security (Washington, DC, Oct.).
13. Gouda, M. G. 1993. Protocol verification made simple: a tutorial. Comput. Netw. ISDN Syst. 25, 9 (Apr.), 969-980.
14. Hauser, R., Przygienda, T., and Tsudik, G. 1997. Reducing the cost of security in link state routing. In Proceedings of the ISOC Symposium on Network and Distributed System Security (Feb.).
15. Herman, T. 2001. Stabilization research at Iowa. http://www.cs.uiowa.edu/ftp/selfstab/main.html.
16. Hopcroft, J. and Ullman, J. 1979. Introduction to Automata Theory, Languages, and Computation. Addison-Wesley, Reading, MA.
17. Huitema, C. 1995. Routing in the Internet. Prentice-Hall, Inc., Upper Saddle River, NJ.
18. Ilgun, K., Kemmerer, R. A., and Porras, P. A. 1995. State transition analysis: A rule-based intrusion detection approach. IEEE Trans. Softw. Eng. 21, 3 (Mar.), 181-199.
19. Javitz, H. S. and Valdest, A. 1991. The SRI IDES statistical anomaly detector. In Proceedings of the 1991 IEEE Symposium on Research in Security and Privacy (May). IEEE Computer Society Press, Los Alamitos, CA, 316-326.
20. Jou, Y., Gong, F., Sargor, C., Wu, S., and Cleaveland, W. 1997. Architecture design for a scalable intrusion detection for the emerging network infrastructure. Tech. Rep. Computer Science Department, NC State, Raleigh, NC. http://www.mcnc.org/HTML/ITD/ANR/JiNao.html.
21. Kumar, S. and Spafford, E. H. 1994. A pattern-matching model for instrusion detection. In Proceedings of the 17th National Conference on Computer Security (Baltimore, MD). 11-21.
22. Lynch, N. 1996. Distributed Algorithms. Morgan Kaufmann, San Mateo, CA.
23. Lynch, N. A. and Tuttle, M. R. 1989. An introduction to input/output automata. CWI Q. 2, 3, 219-246.
24. Moy, J. 1998a. RFC 2328: OSPF version 2. ftp://ftp.isi.edu/in-notes/rfc2328.txt.
25. Moy, J. 1998b. OSPF: Anatomy of an Internet Routing Protocol. Addison-Wesley, Reading, MA.
26. Mukherjee, B., Heberlein, L. T., and Levitt, K. N. 1994. Network intrusion detection. IEEE Network 8, 1 (Jan.).
27. Rouvellou, I. and Hart, G. W. 1995. Automatic alarm correlation for fault identification. In Proceedings of the Conference on INFOCOM (INFOCOM'95, Boston, MA, Apr.). IEEE Press, Piscataway, NJ.
28. Shankar, A. 1992. A simple assertional proof system for real-time systems. In Proceedings of the 13th IEEE Symposium on Real-Time Systems (Dec.). IEEE Computer Society Press, Los Alamitos, CA.
29. Shankar, A. 1994. Reasoning assertionally about real-time systems. Proc. IEEE 82, 1 (Jan.).
30. Shukla, S. K. 2001. Home page on self-stabilization. http://www.cs.albany.edu/sandeep/readme.html.
31. Sobirey, D.-I.M. 1997. Intrusion detection systems bibliography. http://www-rnks.informatik.tu-cottbus.de/sobirey/idsbibl.html.
32. Vetter, B., Wang, F., and Wu, S. 1997. An experimental study of insider attacks for the OSPF routing protocol. In Proceedings of the IEEE International Conference on Network Protocols (ICNP'97, Atlanta, GA, Oct.). IEEE Computer Society Press, Los Alamitos, CA.
33. Wang, F., Gong, F., and Wu, F. 2000. Design and implementation of a new intrusion detection approach: Property-oriented detection. Tech. Rep. MCNC, Research Triangle Park, NC. http://worf.mcnc.org/fwang2.
34. Wang, F., Vetter, B., and Wu, S. 1998. Secure routing protocols: Theory and practice. Tech. Rep. Computer Science Department, NC State, Raleigh, NC. http://shang.csc.ncsu.edu/pubs.html/.
35. Wang, J. 1998. Timed Petri Net. Kluwer Academic Publishers, Hingham, MA.
36. Wu, S., Wang, F., Vetter, B., Cleaveland, R., Jou, Y., Gong, F., and Sargor, C. 1997. Intrusion detection for link-state routing protocols. In Proceedings of the 1997 IEEE Computer Society Symposium on Research in Security and Privacy (Oakland, CA, May). IEEE Computer Society Press, Los Alamitos, CA.