Journal
COMPUTERS & SECURITY
Volume 48, Issue -, Pages 234-245Publisher
ELSEVIER ADVANCED TECHNOLOGY
DOI: 10.1016/j.cose.2014.10.013
Keywords
Entropy; Detection deceiving; Denial of service; DDoS; Intrusion detection; Protocol spoofing
Categories
Funding
- Air Force Office of Scientific Research [FA9550-09-1-0173]
- NSF [CNS-1049765]
- NSF-OCI [1064230]
- US Dept of State [S-LMAQM-12-GR-1033]
- Direct For Computer & Info Scie & Enginr
- Division Of Computer and Network Systems [1228312] Funding Source: National Science Foundation
Ask authors/readers for more resources
Denial of Service (DoS) attacks disable network services for legitimate users. As a result of growing dependence on the Internet by both the general public and service providers, the availability of Internet services has become a concern. While DOS attacks cause inconvenience for users, and revenue loss for service providers; their effects on critical infrastructures like the smart grid and public utilities could be catastrophic. For example, an attack on a smart grid system can cause cascaded power failures and lead to a major blackout. Researchers have proposed approaches for detecting these attacks in the past decade. Anomaly based DoS detection is the most common. The detector uses network traffic statistics; such as the entropy of incoming packet header fields (e.g. source IF addresses or protocol type). It calculates the observed statistical feature and triggers an alarm if an extreme deviation occurs. Entropy features are common in recent DDoS detection publications. They are also one of the most effective features for detecting these attacks. However, intrusion detection systems (IDS) using entropy based detection approaches can be a victim of spoofing attacks. An attacker can sniff the network and calculate background traffic entropy before a (D)DoS attack starts. They can then spoof attack packets to keep the entropy value in the expected range during the attack. This paper explains the vulnerability of entropy based network monitoring systems. We present a proof of concept entropy spoofing attack and show that by exploiting this vulnerability, the attacker can avoid detection or degrade detection performance to an unacceptable level. (C) 2014 Elsevier Ltd. All rights reserved.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available