Backtracking Algorithmic Complexity Attacks against a NIDS

Network Intrusion Detection Systems (NIDS) have become crucial to securing modern networks. To be effective, a NIDS must be able to counter evasion attempts and operate at or near wire-speed. Failure to do so allows malicious packets to slip through a NIDS undetected. In this paper, we explore NIDS evasion through algorithmic complexity attacks. We present a highly effective attack against the Snort NIDS, and we provide a practical algorithmic solution that successfully thwarts the attack. This attack exploits the behavior of rule matching, yielding inspection times that are

• Type: Conference
• Year: 2006
• Where: ACSAC
• Authors: Randy Smith, Cristian Estan, Somesh Jha
• Keywords: ACSAC 2006, Network Intrusion Detection, NIDS Evasion, Security Privacy, Snort NIDS