Conference paper

HOMOLIAK Ivan, OVŠONKA Daniel, GRÉGR Matěj and HANÁČEK Petr. NBA of Obfuscated Network Vulnerabilities' Exploitation Hidden into HTTPS Traffic. In: Proceedings of International Conference for Internet Technology and Secured Transactions (ICITST-2014). London: IEEE Computer Society, 2014, pp. 311-318. ISBN 978-1-908320-40-7.
Publication language:english
Original title:NBA of Obfuscated Network Vulnerabilities' Exploitation Hidden into HTTPS Traffic
Title (cs):NBA obfuskovaných exploitací síťových zranitelností ukrytých do HTTPS provozu
Pages:311-318
Proceedings:Proceedings of International Conference for Internet Technology and Secured Transactions (ICITST-2014)
Conference:The 9th International Conference for Internet Technology and Secured Transactions
Place:London, GB
Year:2014
ISBN:978-1-908320-40-7
Publisher:IEEE Computer Society
Files: 
+Type Name Title Size Last modified
iconcamera-ready-157.pdf452 KB2014-12-29 10:40:07
^ Select all
With selected:
Keywords
traffic obfuscation, protocol tunneling, buffer overflow, network vulnerabilities, NBA, IDS
Annotation
This paper examines the detection properties of obfuscated network buffer overflow attacks by selected IDS and NBA. The obfuscation was performed by tunneling the malicious traffic in HTTP and HTTPS protocols with the intention of simulating the usual legitimate characteristics of the HTTP traffic's flow. The buffer overflow vulnerabilities of four services were used: Samba, BadBlue, Apache, DCOM RPC. Exploitation was performed in a virtual network environment by using scenarios simulating real traffic's conditions as well as legitimate traffic simulations which were performed. Captured data were examined by SNORT and by ASNM network features of the AIPS representing statistically and behaviorally based NBA. The achieved results show an obfuscated attacks transparency for SNORT detection and low detection performance of the AIPS trained by direct attacks and legitimate traffic only in contrast with high classification accuracy of the AIPS trained with an inclusion of obfuscated attacks. Data mining analysis was
performed by using both bi-nominal and poly-nominal classifications, resulting into better performance of poly-nominal classification. At the summary, we emphasize the necessity of training the statistically and behaviorally based NBAs with divergent obfuscation techniques to strengthen their detection capabilities.
BibTeX:
@INPROCEEDINGS{
   author = {Ivan Homoliak and Daniel Ov{\v{s}}onka and Mat{\v{e}}j
	Gr{\'{e}}gr and Petr Han{\'{a}}{\v{c}}ek},
   title = {NBA of Obfuscated Network Vulnerabilities' Exploitation
	Hidden into HTTPS Traffic},
   pages = {311--318},
   booktitle = {Proceedings of International Conference for Internet
	Technology and Secured Transactions (ICITST-2014)},
   year = {2014},
   location = {London, GB},
   publisher = {IEEE Computer Society},
   ISBN = {978-1-908320-40-7},
   language = {english},
   url = {http://www.fit.vutbr.cz/research/view_pub.php.en.iso-8859-2?id=10658}
}

Your IPv4 address: 54.166.150.10
Switch to IPv6 connection

DNSSEC [dnssec]