An efficient TCP reassembler mechanism for layer7-aware network intrusion detection/prevention systems

Miyuki Hanaoka, Kenji Kono, Makoto Shimamura, Satoshi Yamaguchi

Research output: Chapter in Book/Report/Conference proceedingConference contribution

2 Citations (Scopus)

Abstract

Exploiting layer7 context is an effective approach to improving the accuracy of detecting malicious messages in network intrusion detection/prevention systems (NIDS/NIPSs). Unfortunately, layer7-aware NIDS/NIPSs pose crucial implementation issues because they require full TCP/IP reassembly without losing 1) complete prevention, 2) performance, 3) application transparency, or 4) transport transparency. To the best of our knowledge, none of the existing approaches meet all of these requirements. Our store-through does this by forwarding each out-of-order or IP-fragmented packet immediately after copying it even if it has not been checked yet. Although the forwarded packet might turn out to be a part of an attack, the store-through can successfully defend against the attack by blocking one of the subsequent packets Testing of a prototype in Linux kernel 2.4.30 demonstrated that the overhead of our mechanism is negligible compared with that of a simple IP forwarder even with the presence of out-of-order packets.

Original languageEnglish
Title of host publication12th IEEE International Symposium on Computers and Communications, ISCC '07
Pages79-86
Number of pages8
DOIs
Publication statusPublished - 2007 Dec 1
Event12th IEEE International Symposium on Computers and Communications, ISCC '07 - Aveiro, Portugal
Duration: 2007 Jul 12007 Jul 4

Publication series

NameProceedings - IEEE Symposium on Computers and Communications
ISSN (Print)1530-1346

Other

Other12th IEEE International Symposium on Computers and Communications, ISCC '07
CountryPortugal
CityAveiro
Period07/7/107/7/4

ASJC Scopus subject areas

  • Software
  • Signal Processing
  • Mathematics(all)
  • Computer Science Applications
  • Computer Networks and Communications

Fingerprint Dive into the research topics of 'An efficient TCP reassembler mechanism for layer7-aware network intrusion detection/prevention systems'. Together they form a unique fingerprint.

  • Cite this

    Hanaoka, M., Kono, K., Shimamura, M., & Yamaguchi, S. (2007). An efficient TCP reassembler mechanism for layer7-aware network intrusion detection/prevention systems. In 12th IEEE International Symposium on Computers and Communications, ISCC '07 (pp. 79-86). [4381605] (Proceedings - IEEE Symposium on Computers and Communications). https://doi.org/10.1109/ISCC.2007.4381605