Insertion, Evasion, and Denial of Service: Eluding Network Intrusion Detection

Abstract

📜 Abstract

All currently available network intrusion detection (ID) systems rely upon a mechanism of data collection—passive protocol analysis—which is fundamentally flawed. In passive protocol analysis, the intrusion detection system (IDS) unobtrusively watches all traffic on the network, and scrutinizes it for patterns of suspicious activity. We outline in this paper two basic problems with the reliability of passive protocol analysis: (1) there isn't enough information on the wire on which to base conclusions about what is actually happening on networked machines, and (2) the fact that the system is passive makes it inherently “fail-open,” meaning that a compromise in the availability of the IDS doesn't compromise the availability of the network. We define three classes of attacks which exploit these fundamental problems—insertion, evasion, and denial of service attacks—and describe how to apply these three types of attacks to IP and TCP protocol analysis. We present the results of tests of the efficacy of our attacks against four of the most popular network intrusion detection systems on the market. All of the ID systems tested were found to be vulnerable to each of our attacks. This indicates that network ID systems cannot be fully trusted until they are fundamentally redesigned.

Description

✨ Summary

The paper analyzes the reliability of network intrusion-detection systems that passively capture and interpret traffic. It identifies two fundamental limitations: packet observations may not contain enough information to determine how a destination host will process them, and passive monitors are inherently fail-open because disabling the monitor does not disable the protected network.

It formalizes three attack classes. Insertion attacks cause the IDS to accept data that the destination rejects, so the IDS reconstructs a stream containing attacker-controlled material that the target never processes. Evasion attacks exploit the opposite discrepancy: the destination accepts data that the IDS rejects, allowing attack-relevant content to disappear from the IDS’s reconstructed view. Denial-of-service attacks exhaust IDS resources or exploit its response mechanisms, reducing availability or causing potentially harmful countermeasures.

The paper develops these ideas across IP and TCP. It emphasizes packet and stream reassembly, fragmentation, overlapping fragments, sequence-number handling, checksums, TCP flags, connection state, resets, and differences among operating-system implementations. The central technical conclusion is that a network IDS cannot reliably interpret traffic merely by applying a generic protocol model; it must approximate the behavior of the specific destination, network path, and end-system configuration it is monitoring.

The authors implement a scripted test suite covering baseline traffic, IP fragmentation, TCP reassembly, connection-state behavior, insertion, and evasion. Their tests against four commercial network IDS products found exploitable weaknesses in every system tested; the reported results show broad failures involving fragmentation and TCP-stream interpretation.

The paper became a foundational reference for research and practice on network-traffic normalization and IDS evasion. Subsequent work explicitly summarizes and extends its insertion, evasion, and denial-of-service taxonomy, including research on attack development for IDS evaluation. (wenke.gtisc.gatech.edu) Security literature and practitioner guidance continued to cite the paper when discussing packet reassembly, out-of-order TCP traffic, and discrepancies between IDS and endpoint behavior. (nmap.org) The concepts also informed later protocol-analysis systems designed to model endpoint semantics more accurately; related work describes insertion, evasion, and denial-of-service as core threats to passive network monitoring. (fathom.icsi.berkeley.edu)