Accession Number:

ADA391565

Title:

Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection

Descriptive Note:

Corporate Author:

SECURE NETWORKS INC CALGARY ALBERTA

Personal Author(s):

• Ptacek, Thomas H.
• Newsham, Timothy N.

Report Date:

1998-01-01

Pagination or Media Count:

65.0

Abstract:

All currently available network intrusion detection ID systems rely upon a mechanism of data collection passive protocol analysis-which is fundamentally flawed. In passive protocol analysis, the intrusion detection system IDS unobtrusively watches all traffic on the network, and scrutinizes it for patterns of suspicious activity. We outline in this paper two basic problems with the reliability of passive protocol analysis 1 there isnt enough information on the wire on which to base conclusions about what is actually happening on networked machines, and 2 the fact that the system is passive makes it inherently fail-open, meaning that a compromise in the availability of the IDS doesnt compromise the availability of the network. We define three classes of attacks which exploit these fundamentally problems---insertion, evasion and denial of service attacks--and describe how to apply these three types of attacks to IP and TCP protocol analysis. We present the results of tests of the efficacy of our attacks against four of the most popular network intrusion detection systems on the market. All of the ID systems tested were found to be vulnerable to each of our attacks. This indicates that network ID systems cannot be fully trusted until they are fundamentally redesigned.

Descriptors:

• *COMPUTER NETWORKS
• *ELECTRONIC SECURITY
• *INTRUSION DETECTION
• TRAFFIC
• WIRE
• CANADA
• DATA ACQUISITION
• EVASION
• AREA DENIAL

Subject Categories:

• Computer Systems Management and Standards

Distribution Statement:

APPROVED FOR PUBLIC RELEASE