Automatic Generation and Analysis of NIDS Attacks

S. Rubin, S. Jha, B.P. Miller
20th Annual Computer Security Applications Conference  
A common way to elude a signature-based NIDS is to transform an attack instance that the NIDS recognizes into another instance that it misses. For example, to avoid matching the attack payload to a NIDS signature, attackers split the payload into several TCP packets or hide it between benign messages. We observe that different attack instances can be derived from each other using simple transformations. We model these transformations as inference rules in a natural-deduction system. Starting
more » ... system. Starting from an exemplary attack instance, we use an inference engine to automatically generate all possible instances derived by a set of rules. The result is a simple yet powerful tool capable of both generating attack instances for NIDS testing and determining whether a given sequence of packets is an attack. In several testing phases using different sets of rules, our tool exposed serious vulnerabilities in Snort-a widely deployed NIDS. Attackers acquainted with these vulnerabilities would have been able to construct instances that elude Snort for any TCP-based attack, any Web-CGI attack, and any attack whose signature is a certain type of regular expression. 1. Unlike other tools [22, 31, 39, 41] , AGENT is sound, generating instances of real attacks only. Therefore, when a NIDS misses an AGENT-generated attack, the NIDS is vulnerable. 2. AGENT is exhaustive, capable of generating all attack instances from a known instance using a set of rules. Hence, even if a single instance evades a NIDS, AGENT can find it. Similarly, AGENT can show that a NIDS correctly identifies all possible attack instances derived by a given set of transformations. Our results show that AGENT effectively finds NIDS vulnerabilities even without generating all instances. 3. Given a sequence of packets, AGENT can provide a proof, a sequence of transformations used for obfuscation, that the sequence is a real attack. Developers can use AGENT to analyze attacks and to identify the exact transformation that their NIDS fails to handle. An attack derivation model for computing attack instances. We formalized AGENT's inference engine as a natural deduction system [28] and developed a formal model for computing attack instances. Using this model we formalize the black and white hat problems. The model has the following advantages:
doi:10.1109/csac.2004.9 dblp:conf/acsac/RubinJM04 fatcat:7a4wr2q5pbfhpns26umi2xrtfa