Identification of host audit data to detect attacks on low-level IP vulnerabilities

Article type: Research Article

Authors: Daniels, Thomas E. | Spafford, Eugene H.

Affiliations: Center for Education and Research in Information Assurance and Security (CERIAS), Computer Science Building, Purdue University, West Lafayette, IN 47907-1398, USA. E-mail: daniels@cs.purdue.edu, spaf@cs.purdue.edu

Abstract: Conventional host-based and network-based intrusion and misuse detection systems have concentrated on detecting network-based and internal attacks, but little work has addressed host-based detection of low-level network attacks. A major reason for this is the misuse detection system’s dependence on audit data and the absence of low-level network data in audit trails. This work defines low-level IP vulnerabilities and distinguishes between low-level IP and IP-based vulnerabilities. Furthermore, we analyze a number of different low-level IP attacks and the vulnerabilities that they exploit. We develop attack signatures for each attack, and based upon our analysis, we determine a baseline collection of information needed to detect the attacks. We suggest locations within protocol stacks where the needed data can be collected. Finally, we generalize from the baseline audit data to try to predict audit content suitable not only for detecting these attacks, but possible future ones.

DOI: 10.3233/JCS-1999-7102

Journal: Journal of Computer Security, vol. 7, no. 1, pp. 3-35, 1999