Network Security White Papers
Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics
Overview A fundamental problem for network intrusion detection systems is the ability of a skilled attacker to evade detection by exploiting ambiguities in the traffic stream as seen by the monitor. This paper discusses the viability of addressing this problem by introducing a new network forwarding element called a traffic normalizer. The normalizer sits directly in the path of traffic into a site and patches up the packet stream to eliminate potential ambiguities before the traffic is seen by the monitor, removing evasion opportunities. The paper examines a number of tradeoffs in designing a normalizer, emphasizing the important question of the degree to which normalizations undermine end-to-end protocol semantics.
| Publisher | Technische Universitat Munchen | File Format | |
|---|---|---|---|
| Date Published | May 2001 | ||
| Format | White Papers | ||
| Topics | |||
-
Did you find this white paper useful? 1 out of 2 users found this white paper useful
White Paper RSS
Download
Register
