Anti-Hacking White Papers
Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics
Overview A fundamental problem for network intrusion detection systems is the ability of a skilled attacker to evade detection by exploiting ambiguities in the traffic stream as seen by the monitor. We discuss the viability of addressing this problem by introducing a new network forwarding element called a traffic normalizer. The normalizer sits directly in the path of traffic into a site and patches up the packet stream to eliminate potential ambiguities before the traffic is seen by the monitor, removing evasion opportunities. We examine a number of tradeoffs in designing a normalizer, emphasizing the important question of the degree to which normalizations undermine end-to-end protocol semantics. We discuss the key practical issues of "cold start" and attacks on the normalizer, and develop a methodology for systematically examining the ambiguities present in a protocol based on walking the protocol's header. We then present norm, a publicly available user-level implementation of a normalizer that can normalize a TCP traffic stream at 100,000 pkts/sec in memory-to-memory copies, suggesting that a kernel implementation using PC hardware could keep pace with a bidirectional 100 Mbps link with sufficient headroom to weather a high-speed flooding attack of small packets.
| Publisher | ICIR (The ICSI Center for Internet Research) | File Format | HTML |
|---|---|---|---|
| Date Published | May 2001 | Downloads | 6 |
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 1 out of 2 users found this white paper useful
White Paper RSS
Download
Register
