Detecting backdoors

Proceedings of the 9th USENIX Security Symposium

Volumn , Issue , 2000, Pages

  Zhang, Yin ^a   Paxson, Vern ^b  

^a Cornell University ^*  (United States)

^b INTERNATIONAL COMPUTER SCIENCE INSTITUTE   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

BACKDOOR DETECTIONS; INTERACTIVE TRAFFICS; INTERNET ACCESS; LOSS OF ACCURACY; PACKET FILTERS; PACKET SIZE; PRE-FILTERING; TIMING CHARACTERISTICS;

NETWORK SECURITY;

EID: 85084162889     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (28)

1. D. Borman, "Telnet Linemode Option," RFC 1184, Network Information Center, SRI International, Menlo Park, CA, Oct. 1990.
2. G. Bouvigne, "MPEG Audio Layer I/II/III frame header," http://www.mp3-tech.org/programmer/frameheader.html, 2000.
3. CERT Vulnerability Note VN-98.07, http://www.cert.org/vul-notes/VN-98.07.backorifice.html, Oct 1998.
4. M. Crispin, "Internet Message Access Protocol - Version 4," RFC 1730, Network Information Center, DDN Network Information Center, Dec. 1994.
5. daemon9 route@infonexus.com, "LOKI2 (the implementation)," Phrack Magazine, 7(51), Sep. 01, 1997. http://www.infowar.com/iwftp/phrack/Phrack51/P51-06.txt.
6. P. Danzig, S. Jamin, R. Cáceres, D. Mitzel, and D. Estrin, "An Empirical Workload Model for Driving Wide-area TCP/IP Network Simulations," Internetworking: Research and Experience, 3(1), pp. 1-26, 1992.
7. V Gligor, "A Guide to Understanding Covert Channel Analysis of Trusted Systems," NCSC-TG-030, version 1, http://www.radium.ncsc.mil/tpep/library/rainbow/NCSC-TG-030.html, National Computer Security Center, Nov. 1993.
8. Gnapster, http://www.faradic.net/jasta/gnapster.html, 1999.
9. Gnutella, http://gnutella.wego.com, 2000.
10. J. Harrow, "The Consumer Internet Steamroller," The Rapidly Changing Face of Computing, http://www.compaq.com/rcfoc/20000417.html#-Toc480185377, April, 2000.
11. V. Jacobson, C. Leres, and S. McCanne, "tcp-dump," ftp://ftp.ee.lbl.gov/tcpdump.tar.Z, 1991.
12. B. Kantor, "BSD Rlogin," RFC 1282, Network Information Center, SRI International, Menlo Park, CA, Dec. 1991.
13. R. Lippmann, D. Wyschogrod, S. Webster, D. Weber, and S. Gorton, "Using Bottleneck Verification to Find Novel New Attacks with a Low False Alarm Rate," Proc. Recent Advances in Intrusion Detection, Sept. 1998; http://www.zurich.ibm.com/~dac/ProgJRAID98/Talks.html#LippmannJ21.
14. J. Myers and M. Rose, "Post Office Protocol - Version 3," RFC 1939, Network Information Center, DDN Network Information Center, May 1996.
15. Napster, http://www.napster.com, 1999.
16. Napster (Press Room), http://www.napster.com/press.html, 2000.
17. "Napster protocol specification," http://opennap.sourceforge.net/napster.txt, June 2000.
18. OpenNap, http://opennap.sourceforge.net, 2000.
19. V. Paxson and S. Floyd, "Wide-Area Traffic: The Failure of Poisson Modeling," IEEE/ACM Transactions on Networking, 3(3), pp. 226-244, June 1995.
20. V. Paxson, "Bro: A System for Detecting Network Intruders in Real-Time," Proc. USENIX Security Symposium, Jan. 1998.
21. J. Postel, "Simple Mail Transfer Protocol," RFC 821, Network Information Center, SRI International, Menlo Park, CA, Aug. 1982.
22. J. Postel and J. Reynolds, "Telnet Protocol Specification," RFC 854, Network Information Center, SRI International, Menlo Park, CA, May 1983.
23. J. Postel and J. Reynolds, "Telnet Option Specifications," RFC 855, Network Information Center, SRI International, Menlo Park, CA, May 1983.
24. J. Postel and J. Reynolds, "File Transfer Protocol (FTP)," RFC 959, Network Information Center, SRI International, Menlo Park, CA, Oct. 1985.
25. T. Ptacek and T. Newsham, "Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection," Secure Networks, Inc., http://www.aciri.org/vern/Ptacek-Newsham-Evasion-98.ps, Jan. 1998.
26. M. Ranum. "RE: Bypassing firewall," Mailing list firewall-wizards@nfr.net, Feb. 1, 2000.
27. D. Weekly, "How to get around a Napster blockade," http://david.weekly.org/code/napster-proxy.php3, 2000.
28. T. Ylonen, T. Kivinen, M. Saarinen, T. Rinne, and S. Lehtinen, "SSH Transport Layer Protocol," Internet Draft, draft-ietf-secsh-transport-07.txt, May 2000.