COMP 290-040 -- Network Intrusion Detection Spring 2005 MW 12:30-1:45, Sitterson 115 Instructor: Kevin Jeffay Office hours: By appointment SN324, jeffay at cs.unc.edu

Copies of Class Handouts & Lecture Notes

• Introduction and Course Overview (1/20)
• Classes of Attacks and Methods (1/24)
• DDoS History and Intro to Defenses (1/26)
• Ben Wilde -- Worms and Early DDoS Attacks (2/7-9)
• Sushant Rewaskar -- TCP Protocol Attacks (2/9-14)
• Boriana Ditcheva & Lisa Fowler -- Signature-Based Detection (2/16-21)
• Signal Processing Based Methods
  • Jeff Terrell -- Principle components analysis (2/23-28)
  • Lingsong Zhang -- Wavelet methods (3/7-9)
• Doug Brown, Chuck Crews, Keith Makuck -- Intrusion Detection on the UNC Campus (3/1)
• Feng Pan -- Data Mining Based Methods (3/21)
• Brian Begnoche -- AI/Machine Learning Based Methods (3/23-28)
• Alok Shriram -- Statistical Classification (3/28)
• Claire O'Shea -- Honeypots and Tarpits (3/30)
• Ankur Agiwal -- Worm Detection (4/4)
• Stefan Zota -- Backscatter Measurements (4/6)
• Mitigation
  • Ritesh Kumar -- Pushback (4/13)
  • Eric Stone -- Traceback (4/18)
  • Manoj Ampalam -- Ingress/Egress Filtering (4/20)
• Priyank Porwal -- IDS Evasion Techniques (4/25)

• Brief student project progress reports

Papers and Readings

• Overviews/Surveys/Taxonomies
  • Intrusion and Intrusion Detection, John McHugh, International Journal of Information Security, Volume 1, Number 1, pages 14-35, 2001.
  • A Taxonomy of DDoS Attacks and DDoS Defense Mechanisms, Jelena Mirkovic, Janice Martin and Peter Reiher, Computer Science Department, University of California, Los Angeles, Technical report #020018.
  • Research in Intrusion-Detection Systems: A Survey, Stefan Axelsson, Department of Computer Engineering, Chalmers University of Technology, Goteborg, Sweden, TR98-17, revised August 1999.
  • Distributed Denial of Service: Taxonomies of Attacks, Tools, and Countermeasures, Stephen Specht and Ruby Lee, Proceedings of the 17th International Conference on Parallel and Distributed Computing Systems, 2004 International Workshop on Security in Parallel and Distributed Systems, pp. 543-550, September 2004.
  • Intrusion Detection Systems, Rebecca Bace, and Peter Mell, NIST Special Publication on Intrusion Detection Systems, SP 800-31, November 2001.

• Well-Known and Postulated Attacks
  • A Taxonomy of Computer Worms, Nicholas Weaver, Vern Paxson, Stuart Staniford, Robert Cunningham, Proceedings of the 2003 ACM workshop on Rapid Malcode, Washington, DC, October 2003, pages 11-18.

  • The 1988 RTM Internet Worm
    • The Internet Worm Program: An Analysis Eugene H. Spafford, ACM SIGCOMM Computer Communication Review, Volume 19, Number 1 (January 1989), pages 17-57.
    • A Tour of the Worm, Seely, D. Proceedings of the Winter 1989 Usenix Conference, San Diego, CA, 1989, pages 287-304.

  • Early DDoS Attacks & Worms
    • The DoS Project's "trinoo" distributed denial of service attack tool David Dittrich, University of Washington, http://staff.washington.edu/dittrich/misc/ddos/, (see also here), October 1999.
    • Analyzing Distributed Denial Of Service Tools: The Shaft Case, Sven Dietrich, Neil Long, David Dittrich, Proceedings of the 14th Systems Administration Conference (LISA 2000), New Orleans, Louisiana, December 2000, pages 329-339.
    • The "mstream" distributed denial of service attack tool, David Dittrich, George Weaver, Sven Dietrich, Neil Long, University of Washington, http://staff.washington.edu/dittrich/misc/ddos/, May 2000.
    • Inside the Slammer Worm, D. Moore, V. Paxson, S. Savage, C. Shannon, S. Staniford, N. Weaver, IEEE Security and Privacy, pages 33-39, July/August 2003.

  • Relevant CERT/CIAC Incident Notes/Advisories
    • Domain Name System (DNS) Denial of Service (DoS) Attacks, CIAC Information Bulletin J-063, September 1999.
    • Smurf IP Denial-of-Service Attacks, CERT Advisory CA-1998-01, March 2000.
    • mstream Distributed Denial of Service Tool, CERT Incident Note IN-2000-05, May 2000.
    • TCP SYN Flooding and IP Spoofing Attacks, CERT Advisory CA-1996-21, November 2000.
    • Denial of Service Attacks using Nameservers, CERT Incident Note IN-2000-04, January 2001.
    • Trends in Denial of Service Attack Technology, Kevin Houle, George Weaver, CERT Coordination Center, October 2001.

  • TCP Attacks
    • Analysis of a Denial of Service Attack on TCP, Christoph Schuba, Ivan Krsul, Markus Kuhn, Eugene Spafford, Aurobindo Sundaram, Diego Zamboni, Proceedings of the 1997 IEEE Symposium on Security and Privacy, Oakland, CA, May 1997, pages 208-223.
    • TCP Congestion Control with a Misbehaving Receiver, Stefan Savage, Neal Cardwell, David Wetherall, and Tom Anderson, ACM SIGCOMM Computer Communication Review, Volume 29, Number 5 (October 1999), pages 71-78.
    • Low-Rate TCP Targeted Denial of Service Attacks (The Shrew vs. the Mice and Elephants), Aleksandar Kuzmanovic and Edward W. Knightly, Proceedings, ACM SIGCOMM 2003, August 2003, Karlsruhe, Germany.

  • Performance analysis
    • A Worst-Case Worm, N. Weaver, V. Paxson, Proceedings, Third Annual Workshop on Economics and Information Security (WEIS04), May 2004.
    • How to 0wn the Internet in Your Spare Time, Stuart Staniford, Vern Paxson, Nicholas Weaver Proceedings of the 11th USENIX Security Symposium, December 2002.
    • Code Red Worm Propagation Modeling and Analysis, C. C. Zou, W. Gong, and D. Towsley, Proceedings of the 9th ACM Conference on Computer and Communications Security, Washington, DC, November 2002, pages 138-147.

  • A Framework for Malicious Workload Generation, Joel Sommers, Vinod Yegneswaran, Paul Barford, Proceedings, ACM IMC'04, October 2004, Taormina, Sicily, Italy.
  • Scotland Yard and the case of the rent-a-zombies, ZDNet, July 2004.

• Detection
  • Signature-Based Detection
    • Bro: A System for Detecting Network Intruders in Real-Time, V. Paxson, Computer Networks, Volume 31, Numbers 23-24 (December 1999), pages 2435-2463.
    • Enhancing Byte-Level Network Intrusion Detection Signatures with Context, R. Sommer and V. Paxson, Proceedings of the 10th ACM conference on Computer and Communications Security, Washington DC, October 2003, pages 262-271.
    • Snort -- Lightweight Intrusion Detection for Networks, Martin Roesch, Proceedings of LISA '99: 13th Systems Administration Conference, Seattle, WA, November 1999, pages 229-238.
    • Stateful Intrusion Detection for High-Speed Networks, Christopher Kruegel, Fredrik Valeur, Giovanni Vigna, Richard Kemmerer, Proceedings of the 2002 IEEE Symposium on Security and Privacy, Berkeley, CA, May 2002, page 285-294.

  • Signal Processing Based Methods
    • A Signal Analysis of Network Traffic Anomalies, Paul Barford, Jeffery Kline, David Plonka, Amos Ron, Proceedings of the 2nd ACM SIGCOMM Workshop on Internet Measurment, Marseille, France, November 2002, pages 71-82.
    • Use of Spectral Analysis in Defense Against DoS Attacks, Cheng, C-M, Kung, H. T., and Tan, K-S., Proceedings of IEEE GLOBECOM 2002, Taipei, Taiwan. November, 2002.
    • Statistical Approaches to DDoS Attack Detection and Response, Laura Feinstein, Dan Schnackenberg, Ravindra Balupari, Darrell Kindred, Proceedings of the DARPA Information Survivability Conference and Exposition (DISCEX03), Washington, DC, April 2003, pages 303-315.
    • Structural Analysis of Network Traffic Flows, Anukool Lakhina, Konstantina Papagiannaki, Mark Crovella, Christophe Diot, Eric D. Kolaczyk, Nina Taft, ACM SIGMETRICS Performance Evaluation Review, Volume 32, Number 1 (June 2004), pages 61-72.
    • Characterization of Network-Wide Anomalies in Traffic Flows, Anukool Lakhina, Mark Crovella, Christophe Diot, Proceedings of the ACM/SIGCOMM Internet Measurement Conference, October 2004, pages 201-206.
    • Diagnosing Network-Wide Traffic Anomalies, Anukool Lakhina, Mark Crovella, Christophe Diot, ACM SIGCOMM Computer Communication Review, Volume 34, Number 4 (October 2004), pages 219-230.

  • Data Mining Based Methods
    • Mining system audit data: Opportunities and challenges, Wenke Lee, Wei Fan, ACM SIGMOD Record, Volume 30, Number 4 (December 2001), pages 35-44.
    • A Data Mining Framework for Building Intrusion Detection Models, Wenke Lee, Salvatore Stolfo, Kui Mok, Proceedings of the 1999 IEEE Symposium on Security and Privacy, May 1999, pages 120-132.
    • Data Mining-based Intrusion Detectors: An Overview of the Columbia IDS Project, Salvatore Stolfo, Wenke Lee, Philip Chan, Wei Fan, Eleazar Eskin, ACM SIGMOD Record, Volume 30, Number 4 (December 2001), pages 5-14.
    • ADAM: A Testbed for Exploring the Use of Data Mining in Intrusion Detection, Daniel Barbard, Julia Couto, Sushil Jajodia, Ningning Wu, ACM SIGMOD Record, Volume 30, Number 4 (December 2001), pages 15-24.
    • A Framework for Constructing Features and Models for Intrusion Detection Systems, Wenke Lee, Salvatore Stolfo, ACM Transactions on Information and System Security, Vol. 3, No. 4, November 2000, pages 227-261.

  • Specification-Based Detection
    • Specification-based Anomaly Detection: A New Approach for Detecting Network Intrusions, R. Sekar, A. Gupta, J. Frullo, T. Shanbhag, A. Tiwari, H. Yang and S. Zhou, Conference on Computer and Communications Security, Proceedings of the 9th ACM conference on Computer and communications security, Washington, DC, pages 265-274, 2002.
    • An Approach for Detecting Self-Propagating Email Using Anomaly Detection, Ajay Gupta and R. Sekar, Proceedings of the Sixth International Symposium on Recent Advances in Intrusion Detection (RAID), Pittsburgh, PA, September 2003.

  • Worm Detection
    • The EarlyBird System for Real-time Detection of Unknown Worms, Sumeet Singh, Cristian Estan, George Varghese and Stefan Savage, University of California San Deigo, Department of Computer Science, Technical Report CS2003-0761, August 2003.
    • Detecting Early Worm Propagation through Packet Matching, Xuan Chen and John Heidemann, USC Information Sciences Institute Technical Report, ISI-TR-2004-585, February 2004.
    • Designing a Framework for Active Worm Detection on Global Networks, Vincent Berk, George Bakos, Robert Morris, First IEEE International Workshop on Information Assurance (IWIA'03), Darmstadt, Germany, March 2003, pages 13-24.
    • The Monitoring and Early Detection of Internet Worms, Cliff Zou, Weibo Gong, Don Towsley, and Lixin Gao, Proceedings of the 10th ACM Conference on Computer and Communications Security, Washington D.C., pages 190-199.

  • Classification
    • Class-of-Service Mapping for QoS: A Statistical Signature-based Approach to IP Traffic Classification, Matthew Roughan, Subhabrata Sen, Oliver Spatscheck, Nick Duffield, Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement, Taormina, Italy, October 2004, pages 135-148.
    • A Framework for Classifying Denial of Service Attacks, Alefiya Hussain, John Heidemann, Christos Papadopoulos, Proceedings of ACM SIGCOMM 2003, Karlsruhe, Germany, August 2003, pages 99-110.
    • Identification of Repeated Attacks Using Network Traffic Forensics, Alefiya Hussain, John Heidemann, Christos Papadopoulos, Technical Report ISI-TR-2003-577b, USC/Information Sciences Institute, August 2003. Originally released August 2003, updated June 2004.

  • AI/Machine Learning
    • Application of Machine Learning Algorithms to KDD Intrusion Detection Dataset within Misuse Detection Context, Maheshkumar Sabhnani, Gursel Serpen, Proceedings of the International Conference on Machine Learning, Models, Technologies and Applications (MLMTA 2003), Las Vegas, NV, June 2003, pages 209-215.
    • Why Machine Learning Algorithms Fail in Misuse Detection on KDD Intrusion Detection Data Set, Maheshkumar Sabhnani, Gursel Serpen, Journal of Intelligent Data Analysis, 2004.
    • Robust Anomaly Detection Using Support Vector Machines, Wenjie Hu, Yihua Liao, V. Rao Vemuri, IEEE Transactrions on Pattern Analysis and Machine Intelligence.
    • Adaptive Real-Time Anomaly Detection Using Inductively Generated Sequential Patterns, H. Teng, K, Chen, S. Lu, Proceedings of IEEE Symposium on Security and Privacy, Oakland, CA, May 1990, page 278.
    • Fast Portscan Detection Using Sequential Hypothesis Testing, Jaeyeon Jung, Vern Paxson, Arthur W. Berger, Hari Balakrishnan, Proceedings of 2004 IEEE Symposium on Security and Privacy, Berkeley, CA, May 2004, page 211.
    • An Application of Machine Learning to Network Intrusion Detection, Chris Sinclair, Lyn Pierce, Sara Matzner, Proceedings of the 15th Annual Computer Security Applications Conference, December 1999, Phoenix AZ, page 371.
    • An Application of Machine Learning to Anomaly Detection, Terran Lane, Carla E. Brodley, Proceedings of the 20th NIST-NCSC National Information Systems Security Conference, 1997, pages 366-380.
    • Detecting the Abnormal: Machine Learning in Computer Security, Terran Lane, Carla E. Brodley, Technical Report ECE-97-1, Department of Electrical and Computer Engineering, Purdue University, West Lafayette, IN, January 1997.
    • Temporal Sequence Learning and Data Reduction for Anomaly Detection, Terran Lane, Carla Brodley, ACM Transactions on Information and System Security, Volume 2, Number 3, 1999, pages 295-331.

• Measurement and Monitoring
  • Honeypots, Sinks, and Tarpits
    • An Evening with Berferd In Which a Cracker is Lured, Endured, and Studied, Bill Cheswick, Proceedings of the Winter 1992 USENIX Conference, San Francisco, CA, January 1992, pages 163-174.
    • Honeycomb: Creating Intrusion Detection Signatures Using Honeypots, Christian Kreibich, Jon Crowcroft, ACM SIGCOMM Computer Communication Review, Volume 34, Issue 1, January 2004, pages 51-56.
    • A Virtual Honeypot Framework, Niels Provos, Proceedings of the 13th USENIX Security Symposium, San Diego, CA, August 2004, pages 1-14.
    • Know Your Enemy Whitepapers, The Honeynet Project, http://www.honeynet.org/papers/index.html.
    • Defeating Honeypots: Network Issues, Part 1, Laurent Oudot, Thorsten Holz, http://www.securityfocus.com/infocus/1803, 2004.
    • Fighting Spammers With Honeypots: Part 1, Laurent Oudot, http://www.securityfocus.com/infocus/1747, 2003.
    • Problems and Challenges with Honeypots, Lance Spitzner, http://www.securityfocus.com/infocus/1757, 2004.
    • Honeypots: Definitions and Value of Honeypots, Lance Spitzner, http://www.tracking-hackers.com/papers/honeypots.html, 2003.
    • On the Design and Use of Internet Sinks for Network Abuse Monitoring, Vinod Yegneswaran, Paul Barford, Dave Plonka, Proceedings of Symposium on Recent Advances in Intrusion Detection, Sophia Antipolis, France, September 2004, pages 146-165.
    • Implementing and Testing a Virus Throttle, Jamie Twycross, Matthew M. Williamson, Proceedings of the 12th USENIX Security Symposium, Washington, D.C., August 2003, pages 285-294.

  • Backscatter/Global Analysis
    • Inferring Internet Denial-of-Service Activity, David Moore, Geoffrey Voelker, and Stefan Savage, Proceedings of the 10th USENIX Security Symposium, Washington, D.C., August 2001, pages 9-22.
    • Characteristics of Internet Background Radiation, Ruoming Pang, Vinod Yegneswaran, Paul Barford, Vern Paxson, and Larry Peterson, Proceedings of the 4th ACM SIGCOMM Conference on Internet Measurement, Taormina, Sicily, Italy, October 2004, pages 27-40.
    • Internet Intrusions: Global characteristics and prevalence, Vinod Yegneswaran, Paul Barford, Johannes Ullrich, Proceedings of the 2003 ACM SIGMETRICS International Conference on Measurement and Modeling of Computer Systems, San Diego, CA, June 2003, pages 138-147.
    • Network Telescopes: Technical Report, David Moore, Colleen Shannon, Geoffrey Voelker, Stefan Savage, Cooperative Association for Internet Data Analysis (CAIDA), 2004.

  • Flash Crowds and Denial of Service Attacks: Characterization and implications for CDNs and web sites, Jaeyeon Jung, Balachander Krishnamurthy, Michael Rabinovich, Proceedings of the Eleventh International Conference on World Wide Web, Honolulu, Hawaii, May 2002, pages 293-304.

• Router-Based Mitigation
  • Pushback
    • Controlling High Bandwidth Aggregates in the Network, Ratul Mahajan, Steven M. Bellovin, Sally Floyd, John Ioannidis, Vern Paxson, and Scott Shenker, ACM SIGCOMM Computer Communication Review, Volume 32, Issue 3 (July 2002), pages 62-73.
    • Implementing Pushback: Router-Based Defense Against DDoS Attacks, John Ioannidis Steven M. Bellovin, Proceedings of Network and Distributed System Security Symposium, San Diego, California, February 2002, pages 79-96.

  • Ingress/Egress Filtering
    • Hop-Count Filtering: An Effective Defense Against Spoofed Traffic, Cheng Jin, Haining Wang, Kang G. Shin, Proceedings of the 10th ACM International Conference on Computer and Communications Security (CCS), October 2003, pages 30-41.
    • Attacking DDoS at the Source, Jelena Mirkovic, Gregory Prier, Peter Reiher, 10th IEEE International Conference on Network Protocols, Paris, France, November 2002, pages 312-321.
    • On the Effectiveness of Route-Based Packet Filtering for Distributed DoS Attack Prevention in Power-Law Internets, Kihong Park, Heejo Lee, Proceedings of ACM SIGCOMM 2001, San Diego, California, August 2001, pages 15-26.
    • Network Ingress Filtering: Defeating Denial of Service Attacks Which Employ IP Source Address Spoofing, P. Ferguson, D. Senie, RFC 2827, May 2000.

  • Traceback
    • Single-Packet IP Traceback, Alex C. Snoeren, Craig Partridge, Luis A. Sanchez, Christine E. Jones, Fabrice Tchakountio, Beverly Schwartz, Stephen T. Kent, and W. Timothy Strayer, IEEE/ACM Transactions on Networking, Volume 10, Number 6 (December 2002), pages 721-734.
    • Advanced and Authenticated Marking Schemes for IP Traceback, Dawn Xiaodong Song, Adrian Perrig, Proceedings IEEE INFOCOM 2001, Anchorage Alaska, April 2001, pages 878-886.
    • Practical Network Support for IP Traceback, Stefan Savage, David Wetherall, Anna Karlin, Tom Anderson, ACM SIGCOMM Computer Communication Review, Volume 30, Number 4 (October 2000), pages: 295-306.
    • Network Support for IP Traceback, Stefan Savage, David Wetherall, Anna Karlin, and Tom Anderson, IEEE/ACM Transactions on Networking, Volume 9, Number 3 (June 2001), pages 236-237.

• Evading/Attacking a NIDS
  • Insertion Evasion and Denial of Service Eluding Network Intrusion Detection, Thomas H. Ptacek, Timothy N. Newsham, Secure Networks, Inc. Calgary, Alberta, Canada, Technical Report T2R-0Y6, January 1998.
  • Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics, Mark Handley,Vern Paxson, Christian Kreibich, Proceedings of the 10th USENIX Security Symposium, Washington, D.C., August 2001, pages 115-131.
  • Active Mapping: Resisting NIDS Evasion Without Altering Traffic, Umesh Shankar, Vern Paxson, Proceedings of the 2003 IEEE Symposium on Security and Privacy, Berkeley CA, May 2003, pages 44-61.
  • IDS Evasion with Unicode, Eric Hacker, http://www.securityfocus.com/infocus/1232, January 2001.
  • IDS Evasion Techniques and Tactics, Kevin Timm, http://www.securityfocus.com/infocus/1577, May 2002.

Other Useful/Related Links

• Project home pages:
  • Snort
  • DShield
  • Cossack (ISI)
  • Bro
  • D-WARD
  • Emerald
• NANOG Security Curriculum page
• Dave Dietrich's DDoS tools/attacks page