An Achilles Heel in Signature-Based IDS : Squealing False Positives in SNORT

摘要: We report a vulnerability to network signature-based IDS which we have tested using Snort and call “Squealing”. This has significant implications since it can easily be generalized any IDS. The of high false positive rates been welldocumented but go further show (at level) how packets crafted match attack signatures such that alarms on target conditioned or disabled then exploited. is the first academic treatment this already reported CERT Coordination Center National Infrastructure Protection Center. Independently, other tools based “squealing” are poised appear that, while validating our ideas, also gives cause for concern. keywords: squealing, positive, intrusion detection, IDS, signature-based, misuse behavior, snort