On scalable attack detection in the network

摘要: Current intrusion detection and prevention systems seek to detect a wide class of network intrusions (e.g., DoS attacks, worms, port scans)at vantage points. Unfortunately, all the IDS we know keep per-connection or per-flow state. Thus it is hardly surprising that (other than signature mechanisms) have not scaled multi-gigabit speeds. By contrast, note both router lookups fair queuing high speeds using aggregation via prefix DiffServ. in this paper, initiate research into question as whether one can attacks without keeping We will show such aggregation, while making fast implementations possible, immediately cause two problems. First, behavioral aliasing where, for example, good behaviors aggregate look like bad behaviors. Second, aggregated schemes are susceptible spoofing by which intruder sends appropriate behavior. examine variety several categories (bandwidth based, claim-and-hold, host scanning) be scalably detected. appears stealthy port-scanning cannot detected