Publication detail

NBA of Obfuscated Network Vulnerabilities' Exploitation Hidden into HTTPS Traffic

HOMOLIAK, I. OVŠONKA, D. GRÉGR, M. HANÁČEK, P.

Original Title

NBA of Obfuscated Network Vulnerabilities' Exploitation Hidden into HTTPS Traffic

English Title

NBA of Obfuscated Network Vulnerabilities' Exploitation Hidden into HTTPS Traffic

Type

conference paper

Language

en

Original Abstract

This paper examines the detection properties of obfuscated network buffer overflow attacks by selected IDS and NBA. The obfuscation was performed by tunneling the malicious traffic in HTTP and HTTPS protocols with the intention of simulating the usual legitimate characteristics of the HTTP traffic's flow. The buffer overflow vulnerabilities of four services were used: Samba, BadBlue, Apache, DCOM RPC. Exploitation was performed in a virtual network environment by using scenarios simulating real traffic's conditions as well as legitimate traffic simulations which were performed. Captured data were examined by SNORT and by ASNM network features of the AIPS representing statistically and behaviorally based NBA. The achieved results show an obfuscated attacks transparency for SNORT detection and low detection performance of the AIPS trained by direct attacks and legitimate traffic only in contrast with high classification accuracy of the AIPS trained with an inclusion of obfuscated attacks. Data mining analysis was performed by using both bi-nominal and poly-nominal classifications, resulting into better performance of poly-nominal classification. At the summary, we emphasize the necessity of training the statistically and behaviorally based NBAs with divergent obfuscation techniques to strengthen their detection capabilities.

English abstract

This paper examines the detection properties of obfuscated network buffer overflow attacks by selected IDS and NBA. The obfuscation was performed by tunneling the malicious traffic in HTTP and HTTPS protocols with the intention of simulating the usual legitimate characteristics of the HTTP traffic's flow. The buffer overflow vulnerabilities of four services were used: Samba, BadBlue, Apache, DCOM RPC. Exploitation was performed in a virtual network environment by using scenarios simulating real traffic's conditions as well as legitimate traffic simulations which were performed. Captured data were examined by SNORT and by ASNM network features of the AIPS representing statistically and behaviorally based NBA. The achieved results show an obfuscated attacks transparency for SNORT detection and low detection performance of the AIPS trained by direct attacks and legitimate traffic only in contrast with high classification accuracy of the AIPS trained with an inclusion of obfuscated attacks. Data mining analysis was performed by using both bi-nominal and poly-nominal classifications, resulting into better performance of poly-nominal classification. At the summary, we emphasize the necessity of training the statistically and behaviorally based NBAs with divergent obfuscation techniques to strengthen their detection capabilities.

Keywords

traffic obfuscation, protocol tunneling, buffer overflow, network vulnerabilities, NBA, IDS

RIV year

2014

Released

10.12.2014

Publisher

IEEE Computer Society

Location

London

ISBN

978-1-908320-40-7

Book

Proceedings of International Conference for Internet Technology and Secured Transactions (ICITST-2014)

Edition

NEUVEDEN

Edition number

NEUVEDEN

Pages from

310

Pages to

317

Pages count

8

URL

Documents

BibTex


@inproceedings{BUT111612,
  author="Ivan {Homoliak} and Daniel {Ovšonka} and Matěj {Grégr} and Petr {Hanáček}",
  title="NBA of Obfuscated Network Vulnerabilities' Exploitation Hidden into HTTPS Traffic",
  annote="This paper examines the detection properties of obfuscated network buffer
overflow attacks by selected IDS and NBA. The obfuscation was performed by
tunneling the malicious traffic in HTTP and HTTPS protocols with the intention of
simulating the usual legitimate characteristics of the HTTP traffic's flow. The
buffer overflow vulnerabilities of four services were used: Samba, BadBlue,
Apache, DCOM RPC. Exploitation was performed in a virtual network environment by
using scenarios simulating real traffic's conditions as well as legitimate
traffic simulations which were performed. Captured data were examined by SNORT
and by ASNM network features of the AIPS representing statistically and
behaviorally based NBA. The achieved results show an obfuscated attacks
transparency for SNORT detection and low detection performance of the AIPS
trained by direct attacks and legitimate traffic only in contrast with high
classification accuracy of the AIPS trained with an inclusion of obfuscated
attacks. Data mining analysis was 
performed by using both bi-nominal and poly-nominal classifications, resulting
into better performance of poly-nominal classification. At the summary, we
emphasize the necessity of training the statistically and behaviorally based NBAs
with divergent obfuscation techniques to strengthen their detection
capabilities.",
  address="IEEE Computer Society",
  booktitle="Proceedings of International Conference for Internet Technology and Secured Transactions (ICITST-2014)",
  chapter="111612",
  doi="10.1109/ICITST.2014.7038827",
  edition="NEUVEDEN",
  howpublished="online",
  institution="IEEE Computer Society",
  year="2014",
  month="december",
  pages="310--317",
  publisher="IEEE Computer Society",
  type="conference paper"
}