Network intrusion detection: evasion, traffic normalization, and end-to-end protocol semantics

  • Authors:

  • Mark Handley;Vern Paxson;Christian Kreibich

  • Affiliations:

  • AT&T Center for Internet Research at ICSI (ACIRI), International Computer Science Institute, Berkeley, CA;AT&T Center for Internet Research at ICSI (ACIRI), International Computer Science Institute, Berkeley, CA;Institut für Informatik, Technische Universität München, München, Germany

  • Venue:
  • SSYM'01 Proceedings of the 10th conference on USENIX Security Symposium - Volume 10
  • Year:
  • 2001

Quantified Score

Hi-index 0.00

Visualization

Abstract

A fundamental problem for network intrusion detection systems is the ability of a skilled attacker to evade detection by exploiting ambiguities in the traffic stream as seen by the monitor. We discuss the viability of addressing this problem by introducing a new network forwarding element called a traffic normalizer. The normalizer sits directly in the path of traffic into a site and patches up the packet stream to eliminate potential ambiguities before the traffic is seen by the monitor, removing evasion opportunities. We examine a number of tradeoffs in designing a normalizer, emphasizing the important question of the degree to which normalizations undermine end-to-end protocol semantics. We discuss the key practical issues of "cold start" and attacks on the normalizer, and develop a methodology for systematically examining the ambiguities present in a protocol based on walking the protocol's header. We then present norm, a publicly available user-level implementation of a normalizer that can normalize a TCP traffic stream at 100,000 pkts/sec in memory-to-memory copies, suggesting that a kernel implementation using PC hardware could keep pace with a bidirectional 100 Mbps link with sufficient headroom to weather a high-speed flooding attack of small packets.