NDLI: Detecting evasion attacks at high speeds without reassembly

Content Provider	ACM Digital Library
Author	Fingerhut, J. Andrew Bonomi, Flavio Varghese, George
Abstract	Ptacek and Newsham [14] showed how to evade signature detection at Intrusion Prevention Systems (IPS) using TCP and IP Fragmentation. These attacks are implemented in tools like FragRoute, and are institutionalized in IPS product tests. The classic defense is for the IPS to reassemble TCP and IP packets,and to consistently normalize the output stream. Current IPS standards require keeping state for 1 million connections. Both the state and processing requirements of reassembly and normalization are barriers to scalability for an IPS at speeds higher than 10 Gbps.In this paper, we suggest breaking with this paradigm using an approach we call Split-Detect. We focus on the simplest form of signature, an exact string match, and start by splitting the signature into pieces. By doing so the attacker is either forced to include at least one piece completely in a packet, or to display potentially abnormal behavior (e.g., several small TCP fragments or out-of-order packets) that cause the attacker's flow to be diverted to a slow path. We prove that under certain assumptions this scheme can detect all byte-string evasions. We also show using real traces that the processing and storage requirements of this scheme can be 10% of that required by a conventional IPS, allowing reasonable cost implementations at 20 Gbps. While the changes required by Split-Detect may be a barrier to adoption, this paper exposes the assumptions that must be changed to avoid normalization and reassembly in the fast path.
Starting Page	327
Ending Page	338
Page Count	12
File Format	PDF
ISSN	01464833
DOI	10.1145/1151659.1159951
Journal	ACM SIGCOMM Computer Communication Review (CCRV)
Volume Number	36
Issue Number	4
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	1993-07-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Evasion attacks Intrusion prevention systems Tcp reassembly Normalization
Content Type	Text
Resource Type	Article
Subject	Computer Networks and Communications Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Detecting evasion attacks at high speeds without reassembly

Dismantling intrusion prevention systems

Detecting Evasion Attacks at High Speeds Without Reassembly (2006)

Efficient and Robust TCP Stream Normalization

Evasion Techniques: Sneaking through Your Intrusion Detection/Prevention Systems

An intrusion detection and prevention system for IMS and VoIP services

An adaptive framework for dynamic access to bandwith at high speeds

An attack-norm separation approach for detecting cyber attacks

High performance TCP in ANSNET

Detecting evasion attacks at high speeds without reassembly

Similar Documents

Detecting evasion attacks at high speeds without reassembly

Dismantling intrusion prevention systems

Detecting Evasion Attacks at High Speeds Without Reassembly (2006)

Efficient and Robust TCP Stream Normalization

Evasion Techniques: Sneaking through Your Intrusion Detection/Prevention Systems

An intrusion detection and prevention system for IMS and VoIP services

An adaptive framework for dynamic access to bandwith at high speeds

An attack-norm separation approach for detecting cyber attacks

High performance TCP in ANSNET

Detecting evasion attacks at high speeds without reassembly