Intrusion detection system evasion techniques: Difference between revisions

Revision as of 11:22, 7 January 2015

Revision as of 14:08, 13 April 2016

Line 36:

== Denial of service ==

Due to the fact that passive IDS are inherently [[fail-open]] (as opposed to [[fail-closed]]), launching a [[denial-of-service attack]] against the IDS on a network is a feasible method of circumventing its protection.<ref name=":0">{{Cite journal|last=Ptacek|first=Thomas H.|last2=Newsham|first2=Timothy N.|date=1998-01-01|title=Insertion, evasion, and denial of service: Eluding network intrusion detection|url=http://citeseerx.ist.psu.edu/viewdoc/summary?doi=10.1.1.119.399&rank=1}}</ref> An adversary can accomplish this by exploiting a bug in the IDS, consuming all of the computational resources on the IDS, or deliberately triggering a large number of alerts to disguise the actual attack.

An adversary can evade detection by disabling or overwhelming the IDS. This can be accomplished by exploiting a bug in the IDS, using up computational resources on the IDS, or deliberately triggering a large number of alerts to disguise the actual attack. The tools 'stick' and 'snot' were designed to generate a large number of IDS alerts by sending attack signatures across the network, but will not trigger alerts in IDSs that maintain application protocol context.