Evasion Techniques: Sneaking through Your Intrusion Detection/Prevention Systems

Abstract

Abstract-Detecting attacks disguised by evasion techniques is a challenge for signature-based Intrusion Detection Systems (IDSs) and Intrusion Prevention Systems (IPSs). This study examines five common evasion techniques to determine their ability to evade recent systems. The denial-of-service (DoS) attack attempts to disable a system by exhausting its resources. Packet splitting tries to chop data into small packets, so that a system may not completely reassemble the packets for signature matching. Duplicate insertion can mislead a system if the system and the target host discard different TCP/IP packets with a duplicate offset or sequence. Payload mutation fools a system with a mutative payload. Shellcode mutation transforms an attacker's shellcode to escape signature detection. This study assesses the effectiveness of these techniques on three recent signature-based systems, and among them, explains why Snort can be evaded. The results indicate that duplicate insertion becomes less effective on recent systems, but packet splitting, payload mutation and shellcode mutation can be still effective against them.

An Entropy-Based Network Anomaly Detection Method

“…Such systems mostly make use of common signature-based (or misuse-based) technique. This approach is known for its shortcomings [2][3][4][5]. Signatures describe only illegal patterns in network traffic, so a prior knowledge is required [2].…”

“…Signatures describe only illegal patterns in network traffic, so a prior knowledge is required [2]. Signature-based solutions do not cope with evasion techniques and not known yet attacks (0-days) [3]. Moreover, they are unable to detect a specific attack until a rule for the corresponding vulnerability is created, tested, released and deployed, which usually takes long time [4,5].…”

Stream-Oriented Network Traffic Capture and Analysis for High-Speed Networks

“…Scap shares similar goals with Libnids and Stream5. However, previous works treat TCP stream reassembly as a necessity [15], mostly for the avoidance of evasion attacks against intrusion detection systems [7], [8], [10], [29]. On the contrary, Scap views transport-layer streams as the fundamental abstraction that is exported to network monitoring applications, and as the right vehicle to implement aggressive optimizations.…”

“…To make meaningful decisions, these monitoring applications need to analyze network traffic at the transport layer and above. For instance, NIDS reconstruct transport-layer streams to detect attack vectors that span multiple packets, and avoid evasion attacks [7]- [10].…”

“…The stream_process() function calls HTTP_parse() to process the sd->data_len captured bytes of an HTTP stream, starting from the sd->data pointer. The decoded HTTP header values are stored in sd->user_state (lines [10][11]. If the HTTP header remains incomplete in this stream chunk, stream_process() asks from the Scap kernel module to keep this chunk into memory and merge it with the subsequent chunk, until the whole HTTP header is received, using the keep_stream_chunk() function (line 13).…”