RT Conference Proceedings
T1 A functional framework to evade network IDS
A1 Pastrana, Sergio
A1 Orfila, Agustín
A1 Ribagorda Garnacho, Arturo
AB Signature based Network Intrusion Detection Systems (NIDS) apply a set of rules to identify hostile traffic in network segments. Currently they are so effective detecting known attacks that hackers seek new techniques to go unnoticed. Some of these techniques consist of exploiting network protocols ambiguities. Nowadays NIDS are prepared against most of these evasive techniques, as they are recognized and sorted out. The emergence of new evasive forms may cause NIDS to fail. In this paper we present an innovative functional framework to evade NIDS. Primary, NIDS are modeled accurately by means of Genetic Programming (GP). Then, we show that looking for evasions on models is simpler than directly trying to understand the behavior of NIDS. We present a proof of concept showing how to evade a self-built NIDS regarding two publicly available datasets. Our framework can be used to audit NIDS.
PB IEEE
SN 978-1-4244-9618-1
SN 1530-1605
YR 2011
FD 2011-01
LK https://hdl.handle.net/10016/9987
UL https://hdl.handle.net/10016/9987
LA eng
NO Proceeding of: 44th Hawaii International Conference on System Science, Kauai, HI,  January 4-7, 2011
NO This work was partially supported by CDTI, Ministerio de Industria, Turismo y Comercio of Spain in collaboration with Telefonica I+D, Project SEGUR@ CENIT-2007 2004.
DS e-Archivo
RD 30 jun. 2024