Systems and methods for testing and evaluating an intrusion detection system
Systems, methods and devices according to this invention include a plurality of defined modification rules for modifying a sequence of packets that form an attack on an intrusion detection system. These modification rules include both rules that expand the number of packets and rules that reduce the number of packets. The reducing rules can be applied to a given attack instance to identify one or more root attack instances. The expanding rules can then be applied to each root attack instance to generate a corpus of modified attack instances. The modification rules can preserve the semantics of the attack, so that any modified attack instance generated from the given attack instance remains a true attack. To test an intrusion detection system, the corpus of modified attack instances can be used to determine whether an intrusion detection system detects every modified attack instance.
1. A method for testing an intrusion detection system of a type monitoring a network input to detect attacks against a network that would permit unauthorized access to or use of the network, the method executed on at least one electronic computer according to a stored program, comprising:
generating from at least one known attack, a plurality of attack instances, the plurality of attack instances being generated by modifying the known attack using a plurality of transformation rules of a formal transformation system, the transformation rules changing data of the known attack while preserving the effect of the known attack as an attack on a network that would permit unauthorized access to or use of the network;
presenting to the intrusion detection system being tested at the network input of the intrusion detection system, each of a plurality of attack instances;
determining, for each presented attack instance, cases when the intrusion detection system being tested is presented with an attack instance and the intrusion detection system does not identify the attack instance as an attack in response to being presented with that attack instance; and
evaluating the intrusion detection system being tested based on the determining of cases when the intrusion detection system being tested is presented with an attack instance and the intrusion detection system does not identify the attack instance as an attack, such cases indicating failure of the intrusion detection device to protect the network from attacks of a type intended to permit unauthorized access to or use of the network.
2. The method of claim 1 , wherein presenting each of the plurality of attack instances corresponding to the given attack to the intrusion detection system being tested comprises:
selecting one of the plurality of attack instances, each attack instance comprising at least a sequence of at least one attack packet;
presenting the sequence of at least one attack packet of the selected attack instance to the intrusion detection system being tested; and
repeating the selecting and presenting steps for each of the plurality of attack instances.
3. The method of claim 1 , wherein evaluating the intrusion detection system being tested comprises:
identifying at least one attack instance for which the intrusion detection system failed to detect the attack instance as an attack;
determining, for at least one attack instance for which the intrusion detection system failed to detect the attack instance as an attack, if the intrusion detection system failed to detect that attack instance as an attack due to the intrusion detection system lacking a signature that matches that attack instance; and if so,
modifying a set of attack signatures provided to the intrusion detection system such that the set of attack signatures includes at least one attach signature that is usable to detect that attack instance as an attack.
4. The method of claim 1 , wherein evaluating the intrusion detection system being tested comprises:
identifying at least one attack instance for which the intrusion detection system failed to detect the attack instance as an attack;
determining, for at least one attack instance for which the intrusion detection system failed to detect the attack instance as an attack, if the intrusion detection system failed to detect that attack instance as an attack due to a structural limitation in the intrusion detection system; and if so,
modifying the intrusion detection system based on that attack instance so that the intrusion detection system is able to detect that attack instance as an attack.
5. An intrusion detection system comprising:
an electronic computer communicating with an intrusion detection system to be tested, the intrusion detection system being of a type monitoring a network connection to detect attacks against a network that would permit unauthorized access to or use of the network, the electronic computer executing a stored program to:
generate from at least one known attack, a plurality of attack instances, the plurality of attack instances being generated by modifying the known attack using a plurality of transformation rules of a formal transformation system, the transformation rules changing data of the known attack while preserving the effect of the known attack as an attack on a network that would permit unauthorized access to or use of the network;
present each of the plurality of attack instances to the intrusion detection system at an input of the intrusion detection system intended to receive a network connection to a monitored network;
determine, for each presented attack instance, cases when the intrusion detection system being tested is presented with an attack instance and the intrusion detection system does not identify the attack instance as an attack;
evaluate the intrusion detection system being tested based on the determining of cases when the intrusion detection system being tested is presented with an attack instance and the intrusion detection system does not identify the attack instance as an attack, such cases indicating failure of the intrusion detection device to protect the network from attacks of a type intended to permit unauthorized access to or use of the network.
6. The intrusion detection system of claim 5 wherein the electronic computer further executes the stored program to:
for at least one given attack instance that the intrusion detection system does not identify as an attack, modify at least one attack signature presented to the intrusion detection system to form a modified attack signature, the modified attack signature usable by the intrusion detection system to detect the given attack instance.