Other formats:
BibTeX
LaTeX
RIS
@misc{970621,
author = {Drašar, Martin and Vykopal, Jan},
keywords = {NetFlow;bruteforce attacks;flow stretching;evading detection;automatic detection;},
language = {eng},
title = {Bruteforcing in the Shadows - Evading Automated Detection},
url = {http://www.cert.org/flocon/2012/proceedings-2012.html},
year = {2012}
}
TY - GEN
ID - 970621
AU - Drašar, Martin - Vykopal, Jan
PY - 2012
TI - Bruteforcing in the Shadows - Evading Automated Detection
KW - NetFlow;bruteforce attacks;flow stretching;evading detection;automatic detection;
UR - http://www.cert.org/flocon/2012/proceedings-2012.html
L2 - http://www.cert.org/flocon/2012/presentations/drasar-vykopal-bruteforcing-in-the-shadows.pdf
N2 - Networks of today face multitude of attacks of various complexities, but research of suitable defences is often done on limited or unsuitable datasets or insufficient testbeds. Therefore many proposed detection mechanisms are usable only for relatively small subsets of attacks, which significantly disturbs traffic patterns such as flooding attacks or massive port scans. At Masaryk University, which has about 15,000 networked computers, we employ a wide range of detection tools based on NetFlow, such as port scan, botnet, and brute-force attack detectors. Their initial versions proved to be useful for detecting attacks that generate significant behavioral changes in traffic patterns. However we have found that there are several techniques to lessen the behavioral impact and in effect to hide an attack from the detection mechanisms. In our presentation we will discuss three such techniques. The first one restricts the number of attempts in a given time window under the detection threshold. The second and the third ones mimic legitimate traffic either by inserting irregular delays between individual attack attempts or by exploiting features of protocols to create the illusion of legitimate traffic. These methods are inexpensive to implement, but they can be very effective for evading detection. Therefore we would like to raise awareness about them and their importance for designing new detection methods.
ER -
DRAŠAR, Martin and Jan VYKOPAL. \textit{Bruteforcing in the Shadows - Evading Automated Detection}. 2012.
|
