Abstract:Intrusion prevention systems (IPSs) not only attempt to detect attacks but also block malicious traffic and pro-actively tear down pertinent network connections. To effectively thwart attacks, IPSs have to operate both in real-time and inline fashion. This dual mode renders the design/implementation and more importantly the testing of IPSs a challenge. In this paper, we propose an IPS testing framework termed IPS Evaluator which consists of a trace-driven inline simulator-engine, mechanisms for generating and manipulating test cases, and a comprehensive series of test procedures. The engine features attacker and victim interfaces which bind to the external and internal ports of an IPS-under-testing (IUT). Our engine employs a bi-directional injection policy to ensure that replayed packets are subject to security inspection by the IUT before they are forwarded. Furthermore, the send-and-receive mechanism of our engine allows for the correlation of engine-replayed and IUT-forwarded packets as well as the verification of IUT actions on detected attacks. Using dynamic addressing and routing techniques, our framework rewrites both source and destination addresses for every replayed packet on-the-fly. In this way, replayed packets conform to the specific features of the IUT. We propose algorithms to partition attacker/victim-emanated packets so that they are subjected to security inspections by the IUT and in addition, we offer packet manipulation operations to shape replayed traces. We discuss procedures that help verify the IUT's detection and prevention accuracy, attack coverage and behavior under diverse traffic patterns. Finally, we evaluate the strengths of our framework by mainly examining the open-source IPS Snort-Inline. IPS deficiencies revealed during testing help establish the effectiveness of our approach.

Towards Practical IPSec over Challenged Networks

VPN Test System Based on IPSec Network Protocol

A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Implementation of IPSec IKE

Study of Implementing IPSec under the Linux Platform

Design and Implementation of Embedded VPN Gateway System

A New Approach for Accelerating IPSec Communication

Research and Implementation of one Kind of IPSec -based VPN in Linux

A Design and Implementation Method of IPSec Security Chip for Power Distribution Network System Based on National Cryptographic Algorithms

Toward A Practical Scheme For Ipsec Management

Design and Implementation of IPsec VPN IoT Gateway System in National Secret Algorithm

A High Performance Parallel Ipsec-Vpn Gateway Design

Research & Implementation of Security Communication Mechanism for Virtual Private Network

Implementation and Performance Evaluation of IPSec VPN Based on Netfilter

Comprehensive Experiment Design of IPSec based on VMWare

Design and Implementation of IP Security

A Pragmatic Methodology for Testing Intrusion Prevention Systems

IPSec:Fundamental of Network Security and VPN

Application of IPSec Technique to VPN

Based-compactPCI Research and Implementation of IPSec with Paralleled Architecture

The Design And Implementation Of Router Security Subsystem Based On Ipsec