Abstract:Intrusion prevention systems (IPSs) not only attempt to detect attacks but also block malicious traffic and pro-actively tear down pertinent network connections. To effectively thwart attacks, IPSs have to operate both in real-time and inline fashion. This dual mode renders the design/implementation and more importantly the testing of IPSs a challenge. In this paper, we propose an IPS testing framework termed IPS Evaluator which consists of a trace-driven inline simulator-engine, mechanisms for generating and manipulating test cases, and a comprehensive series of test procedures. The engine features attacker and victim interfaces which bind to the external and internal ports of an IPS-under-testing (IUT). Our engine employs a bi-directional injection policy to ensure that replayed packets are subject to security inspection by the IUT before they are forwarded. Furthermore, the send-and-receive mechanism of our engine allows for the correlation of engine-replayed and IUT-forwarded packets as well as the verification of IUT actions on detected attacks. Using dynamic addressing and routing techniques, our framework rewrites both source and destination addresses for every replayed packet on-the-fly. In this way, replayed packets conform to the specific features of the IUT. We propose algorithms to partition attacker/victim-emanated packets so that they are subjected to security inspections by the IUT and in addition, we offer packet manipulation operations to shape replayed traces. We discuss procedures that help verify the IUT's detection and prevention accuracy, attack coverage and behavior under diverse traffic patterns. Finally, we evaluate the strengths of our framework by mainly examining the open-source IPS Snort-Inline. IPS deficiencies revealed during testing help establish the effectiveness of our approach.

Passive Testing on Tcp

A Formal Approach for Passive Testing of Protocol Data Portions

An Enhanced Passive Testing Tool for Network Protocols

Network Protocol System Monitoring - A Formal Approach with Passive Testing

From Active to Passive — Progress in Testing Internet Routing Protocols

Testing Methods of Transmitted Performance about the Local Area Network Based on Ethernet Technology

OnLine Test System, An Application of Passive Testing in Routing Protocols Test

Port Scanning Techniques and Analysis of Attack and Defense

PTFW: a protocol testing framework for wireless sensor networks

On the effective evaluation of TCP

Automatic test packet generation

TCP-Fuzz: Detecting Memory and Semantic Bugs in TCP Stacks with Fuzzing

A Hypothesis Testing Based Scalable TCP Scan Detection.

A New Method of Fault Tolerance Tcp

A Formal Method to Real-Time Protocol Interoperability Testing

Study on conformance testing of hypertext transfer protocol

Active – Passive: On Preconceptions of Testing

An Automated Mechanism of Security Test on Network Protocols

A Pragmatic Methodology for Testing Intrusion Prevention Systems

TPBT - a TraversalProbability BasedConformance Testing Method Forprotocols Specifiedas Communicating Finite Sate Machines

Critical path analysis of TCP transactions