NDLI: An experience developing an IDS stimulator for the black-box testing of network intrusion detection systems

Content Provider	IEEE Xplore Digital Library
Author	Mutz, D. Vigna, G. Kemmerer, R.
Copyright Year	2003
Description	Author affiliation: Reliable Software Group, California Univ., Santa Barbara, CA, USA (Mutz, D.; Vigna, G.; Kemmerer, R.)
Abstract	Signature-based intrusion detection systems use a set of attack descriptions to analyze event streams, looking for evidence of malicious behavior. If the signatures are expressed in a well-defined language, it is possible to analyze the attack signatures and automatically generate events or series of events that conform to the attack descriptions. This approach has been used in tools whose goal is to force intrusion detection systems to generate a large number of detection alerts. The resulting "alert storm" is used to desensitize intrusion detection system administrators and hide attacks in the event stream. We apply a similar technique to perform testing of intrusion detection systems. Signatures from one intrusion detection system are used as input to an event stream generator that produces randomized synthetic events that match the input signatures. The resulting event stream is then fed to a number of different intrusion detection systems and the results are analyzed. This paper presents the general testing approach and describes the first prototype of a tool, called Mucus, that automatically generates network traffic using the signatures of the Snort network-based intrusion detection system. The paper describes preliminary cross-testing experiments with both an open-source and a commercial tool and reports the results. An evasion attack that was discovered as a result of analyzing the test results is also presented.
Sponsorship	Applied Comput. Security Associates
Starting Page	374
Ending Page	383
File Size	311453
Page Count	10
File Format	PDF
ISBN	0769520413
DOI	10.1109/CSAC.2003.1254342
Language	English
Publisher	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Publisher Date	2003-12-08
Publisher Place	USA
Access Restriction	Subscribed
Rights Holder	Institute of Electrical and Electronics Engineers, Inc. (IEEE)
Subject Keyword	Intrusion detection System testing Application software Telecommunication traffic Performance analysis Computer network reliability Computer science Performance evaluation Impedance matching Automatic testing
Content Type	Text
Resource Type	Article

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Evaluating Intrusion Detection Systems in High Speed Networks

An Experience Developing an IDS Stimulator for the Black-Box Testing of Network Intrusion Detection Systems (2003)

Network Traffic Emulation for IDS Evaluation

An experience developing an IDS stimulator for the black-box testing of network intrusion detection systems (2003)

Application Level IDS using Protocol Analysis

An automated environment for software testing and reliability estimation

Network Intrusion Detection Systems in High-Speed Traffic in Computer Networks

Automatic Evaluation of Intrusion Detection Systems

An Improved Technology for Content Matching Intrusion Detection System

An experience developing an IDS stimulator for the black-box testing of network intrusion detection systems

Similar Documents

Evaluating Intrusion Detection Systems in High Speed Networks

An Experience Developing an IDS Stimulator for the Black-Box Testing of Network Intrusion Detection Systems (2003)

Network Traffic Emulation for IDS Evaluation

An experience developing an IDS stimulator for the black-box testing of network intrusion detection systems (2003)

Application Level IDS using Protocol Analysis

An automated environment for software testing and reliability estimation

Network Intrusion Detection Systems in High-Speed Traffic in Computer Networks

Automatic Evaluation of Intrusion Detection Systems

An Improved Technology for Content Matching Intrusion Detection System

An experience developing an IDS stimulator for the black-box testing of network intrusion detection systems