Evaluating intrusion prevention systems with evasions

Abstract

Intrusion prevention systems have become a common security measure in the past 20 years. Their promise is the possibility to prevent known attacks against vulnerable, unpatched devices inside enterprise networks. However, evasion techniques that enable the attacker to evade the eye of the intrusion prevention system are a potential problem for this capability. These techniques take advantage of the robustness principle that has guided designers to create systems that will try to recreate protocol content from any input they receive.In this work, we evaluated the effectiveness of 35 well-known evasions against 9 commercial and 1 free, state-of-the-art, intrusion prevention systems. We conducted 4 experiments with one million attacks against each device. Each system lets a significant amount (0.1%-45%) of attacks pass through unrecognized. Our results show that most existing intrusion prevention systems are vulnerable against evasions.

Detection and Recognition of Atomic Evasions Against Network Intrusion Detection/Prevention Systems

“…Vidal et al [6] classified the most representative evasion techniques into five categories: Insertion and Evasion, Denial of Service, Malware Obfuscation, Link Layer, and Application Layer. A single evasion technique is called an atomic evasion [7]. Xiong et al [8] summarized common atomic evasion techniques and at least 147 atomic evasions have been discovered [9].…”

“…Modern NIDS vendors publish extensive performance testing results regarding the line speed and breadth of attacks detected by their systems, but little information regarding their resilience to evasions. A recent effectiveness evaluation of 35 well-known evasions against nine commercial and one free state-of-the-art NIDS showed that even a single evasion technique from the 1990s with suitable parameters can successfully evade the detection of the best existing NIDS [7]. Cheng et al [11] assessed the effectiveness of evasion techniques for FortiGate, Snort and ZyXEL.…”