[转载]Insertion-Evasion Paper

原始连接：http://www.trialbyfireclass.com: ... s/insertionevasion/

Deluxe Packaging, Digitally Remastered Edition of Insertion, Evasion, and Denial of Service.

We outline in this paper two basic problems with the reliability of passive protocol analysis: (1) there isn't enough information on the wire on which to base conclusions about what is actually happening on networked machines, and (2) the fact that the system is passive makes it inherently ``fail-open,'' meaning that a compromise in the availability of the IDS doesn't compromise the availability of the network.

Table of Contents

Abstract

Introduction

Problems With Network ID Systems

Attacks

Network-Layer Problems

TCP Transport-Layer Problems

Denial of Service Attacks

Methodology

Results

Discussion

References

Thanks

About CASL