Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics

By Mark James Handley, Vern Paxson, Christian Peter Kreibich. USENIX Security Symposium, 2001

517 citations recorded by the source corpus.

View Paper: https://www.semanticscholar.org/paper/c43ae0e0d64b5af9298b1dc7ac0d3951b350e258

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

Citations in the corpus

IP covert timing channels: design and detection (2004, background): “In addition, covert storage channels can sometimes be detected by observing variations in unused packet header fields [17].”
Is it still possible to extend TCP? (2011, background): “To improve performance [2, 7, 18, 3], reduce security exposure [15, 29], enhance control, and work around address space shortages [22], the Internet has experienced an invasion of middleboxes that do care about what the packets contain, and perform processing at layer 4 or higher within the network.”
Learning nonstationary models of normal network traffic for detecting novel attacks (2002, background): “[7] studied four commercial intrusion detection systems and found that none of them reassembled fragmented IP packets, a legal but rarely used feature of the IP protocol.”
Network traffic anomaly detection based on packet bytes (2003, background): “Attackers may deliberately manipulate network protocols to hide an attack from an improperly coded intrusion detection system (IDS) monitoring the application layer [3, 12].”
Mimicry attacks on host-based intrusion detection systems (2002, background): “It is not enough to design a system that can withstand those attacks that are common at the time the system is deployed.”
Enhancing byte-level network intrusion detection signatures with context (2003, background): “Due to state-holding time-outs, ambiguities (s e [27, 16] and [25] for discussion of how these occur for benign reas ons in practice) and non-analyzed packets (which can be caused by p acket filter drops, or by internal sanity checks), TCP stream analy zers will generally wind up with slightly diffe”
Change-point monitoring for the detection of DoS attacks (2004, background): “state for each TCP connection, CPM does not have the cold-start problem(3) mentioned in [19].”
How Hard Can It Be? Designing and Implementing a Deployable Multipath TCP (2012, background): “We also found one path that did this without exhibiting any other proxy behavior - this is symptomatic of a traffic normalizer[8] - and one on port 80 that reset the connection.”
Misleading worm signature generators using deliberate noise injection (2006, methodology): “Researchers in this area have used TCP/IP transformations to demonstrate IDS evasions [16], and address weaknesses created by ambiguities in network protocols [4].”
An Inside Look at Botnets (2007, unknown): “While none of the bots we evaluated included TCP obfuscation s such as those described in [20], the aforementioned encoders provide obfus cation in a limited way.”
Shield: vulnerability-driven network filters for preventing known vulnerability exploits (2004, background): “For more reliable attack detection, “traffic normalizers” [37, 14] or “protocol scrubbers” [20] have been proposed to protect the forwarding path by eliminating potential ambiguities before the traffic is seen by the monitor, thus removing evasion opportunities.”
Embedding Covert Channels into TCP/IP (2005, background): “As is shown in [7,8], an active warden can remove most, if not all, TCP/IP level steganography, and lower layer steganography will already have been removed by routing.”
A framework for the evaluation of intrusion detection systems (2006, unknown): “Several researchers have pointed out the need to include the resistance against attacks as part of the evaluation of an IDS [25, 27, 11 , 34, 29, 30, 13].”
Adversarial attacks against intrusion detection systems: Taxonomy, solutions and open issues (2013, background): “Traffic Normalization: Network traffic can be processed to eliminate interpretation ambiguities, by reducing the amount of connection state information that network sensors must manage [114], [58], [166], [38].”
Automated Worm Fingerprinting (2004, background): “To address this issue requires traf(cid:2)c normalization , in which datagrams are re-assembled in a single consistent fashion [14].”
When a Tree Falls: Using Diversity in Ensemble Classifiers to Identify Evasion in Malware Detectors (2016, background): “One of the main weaknesses of systems that employ machine learning classification in adversarial environments is their susceptibility to evasion attacks.”