A Tool for Offline and Live Testing of Evasion Resilience in Network Intrusion Detection Systems

Juan, Leo; Kreibich, Christian; Lin, Chih-Hung; Paxson, Vern

doi:10.1007/978-3-540-70542-0_14

Cited by 7 publications

(6 citation statements)

References 9 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Combinations. Evasions based on modifications at each of the application, transport and network layers of the TCP/IP stack are described in [32] and [33]. Cheng et al [32] described general evasion techniques and examined the detection performance of signature-based NIDS when performing mutation of known attacks.…”

Section: Related Workmentioning

confidence: 99%

Improving Network Intrusion Detection Classiﬁers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach

Homoliak¹,

Teknős²,

Ochoa³

et al. 2019

ICST Transactions on Security and Safety

View full text Add to dashboard Cite

Machine-learning based intrusion detection classifiers are able to detect unknown attacks, but at the same time they may be susceptible to evasion by obfuscation techniques. An adversary intruder which possesses a crucial knowledge about a protection system can easily bypass the detection module. The main objective of our work is to improve the performance capabilities of intrusion detection classifiers against such adversaries. To this end, we firstly propose several obfuscation techniques of remote attacks that are based on the modification of various properties of network connections; then we conduct a set of comprehensive experiments to evaluate the effectiveness of intrusion detection classifiers against obfuscated attacks. We instantiate our approach by means of a tool, based on NetEm and Metasploit, which implements our obfuscation operators on any TCP communication. This allows us to generate modified network traffic for machine learning experiments employing features for assessing network statistics and behavior of TCP connections. We perform evaluation on five classifiers: Gaussian Naïve Bayes, Gaussian Naïve Bayes with kernel density estimation, Logistic Regression, Decision Tree, and Support Vector Machines. Our experiments confirm the assumption that it is possible to evade the intrusion detection capability of all classifiers trained without prior knowledge about obfuscated attacks, causing an exacerbation of the TPR ranging from 7.8% to 66.8%. Further, when widening the training knowledge of the classifiers by a subset of obfuscated attacks, we achieve a significant improvement of the TPR by 4.21% -73.3%, while the FPR is deteriorated only slightly (0.1% -1.48%). Finally, we test the capability of an obfuscations-aware classifier to detect unknown obfuscated attacks, where we achieve over 90% detection rate on average for most of the obfuscations. intrusion detection suffers from undetected attacks such as zero-day attacks or polymorphism, enabling an exploit-code to avoid positive signature matching of the packet payload data. Therefore, researchers and developers are motivated to design new methods to detect various versions of the modified network attacks including the zero-day ones. These goals motivate the popularity of Anomaly Detection Systems (ADS) and also the classification approaches in the context 1 EAI Endorsed Transactions Preprint

show abstract

Section: Related Workmentioning

confidence: 99%

Improving Network Intrusion Detection Classiﬁers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach

Homoliak¹,

Teknős²,

Ochoa³

et al. 2019

ICST Transactions on Security and Safety

View full text Add to dashboard Cite

show abstract

“…In paper [5], prototype system IDSprobe is introduced which tests the accuracy of NIDS to detect and handle evasion attacks. Author of paper [7] introduces Split Detect approach where in he focuses on splitting the signature into pieces.By splitting the signature the attacker is forced to include at least one piece of information completely and then the abnormal behavior of packets can be identified.…”

Section: ____________________________________________________________mentioning

confidence: 99%

A Combined Approach to Search for Evasion Techniques in Network Intrusion Detection System

Patil¹,

Devale²

2014

IJRET

View full text Add to dashboard Cite

show abstract

“…Besides the evasion tools listed in Table I, a few other tools can also generate evasion traffic, such as FTester (dev.inversepath.com/trac/ftester), idsprobe [37] and AGENT [38]. These tools can play several combinations of evasion techniques based on packet splitting and duplicate insertion, as well as a few payload mutations.…”

Section: B Evasion Toolsmentioning

confidence: 99%

“…We assess only signature-based IPSs since they are dominant in operational environments [2]. We also notice that Juan et al [37] …”

Section: Evasion Testingmentioning

confidence: 99%

Evasion Techniques: Sneaking through Your Intrusion Detection/Prevention Systems

Cheng

Lin

Lai

et al. 2012

IEEE Commun. Surv. Tutorials

View full text Add to dashboard Cite

Abstract-Detecting attacks disguised by evasion techniques is a challenge for signature-based Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs). This study examines five common evasion techniques to determine their ability to evade recent systems. The denial-of-service (DoS) attack attempts to disable a system by exhausting its resources. Packet splitting tries to chop data into small packets, so that a system may not completely reassemble the packets for signature matching. Duplicate insertion can mislead a system if the system and the target host discard different TCP/IP packets with a duplicate offset or sequence. Payload mutation fools a system with a mutative payload. Shellcode mutation transforms an attacker's shellcode to escape signature detection. This study assesses the effectiveness of these techniques on three recent signature-based systems, and among them, explains why Snort can be evaded. The results indicate that duplicate insertion becomes less effective on recent systems, but packet splitting, payload mutation and shellcode mutation can be still effective against them.

show abstract

A Tool for Offline and Live Testing of Evasion Resilience in Network Intrusion Detection Systems

Cited by 7 publications

References 9 publications

Improving Network Intrusion Detection Classiﬁers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach

Improving Network Intrusion Detection Classiﬁers by Non-payload-Based Exploit-Independent Obfuscations: An Adversarial Approach

A Combined Approach to Search for Evasion Techniques in Network Intrusion Detection System

Evasion Techniques: Sneaking through Your Intrusion Detection/Prevention Systems

Contact Info

Product

Resources

About