Publication details

 

Bruteforcing in the Shadows - Evading Automated Detection

Basic information
Original title:Bruteforcing in the Shadows - Evading Automated Detection
Authors:Martin Drašar, Jan Vykopal
Further information
Citation:DRAŠAR, Martin a Jan VYKOPAL. Bruteforcing in the Shadows - Evading Automated Detection. 2012.Export BibTeX
@misc{970621,
author = {Drašar, Martin and Vykopal, Jan},
keywords = {NetFlow;bruteforce attacks;flow stretching;evading detection;automatic detection;},
language = {eng},
title = {Bruteforcing in the Shadows - Evading Automated Detection},
url = {http://www.cert.org/flocon/2012/proceedings-2012.html},
year = {2012}
}
Original language:English
Field:Informatics
WWW:link to a new windowWebová stránka konference, link to a new windowSlidy prezentace
Type:R&D Presentation
Keywords:NetFlow;bruteforce attacks;flow stretching;evading detection;automatic detection;
Attached files:link to a new windowbruteforcing.pdf

Networks of today face multitude of attacks of various complexities, but research of suitable defences is often done on limited or unsuitable datasets or insufficient testbeds. Therefore many proposed detection mechanisms are usable only for relatively small subsets of attacks, which significantly disturbs traffic patterns such as flooding attacks or massive port scans. At Masaryk University, which has about 15,000 networked computers, we employ a wide range of detection tools based on NetFlow, such as port scan, botnet, and brute-force attack detectors. Their initial versions proved to be useful for detecting attacks that generate significant behavioral changes in traffic patterns. However we have found that there are several techniques to lessen the behavioral impact and in effect to hide an attack from the detection mechanisms. In our presentation we will discuss three such techniques. The first one restricts the number of attempts in a given time window under the detection threshold. The second and the third ones mimic legitimate traffic either by inserting irregular delays between individual attack attempts or by exploiting features of protocols to create the illusion of legitimate traffic. These methods are inexpensive to implement, but they can be very effective for evading detection. Therefore we would like to raise awareness about them and their importance for designing new detection methods.

Related projects: