Abstract:Intrusion prevention systems (IPSs) not only attempt to detect attacks but also block malicious traffic and pro-actively tear down pertinent network connections. To effectively thwart attacks, IPSs have to operate both in real-time and inline fashion. This dual mode renders the design/implementation and more importantly the testing of IPSs a challenge. In this paper, we propose an IPS testing framework termed IPS Evaluator which consists of a trace-driven inline simulator-engine, mechanisms for generating and manipulating test cases, and a comprehensive series of test procedures. The engine features attacker and victim interfaces which bind to the external and internal ports of an IPS-under-testing (IUT). Our engine employs a bi-directional injection policy to ensure that replayed packets are subject to security inspection by the IUT before they are forwarded. Furthermore, the send-and-receive mechanism of our engine allows for the correlation of engine-replayed and IUT-forwarded packets as well as the verification of IUT actions on detected attacks. Using dynamic addressing and routing techniques, our framework rewrites both source and destination addresses for every replayed packet on-the-fly. In this way, replayed packets conform to the specific features of the IUT. We propose algorithms to partition attacker/victim-emanated packets so that they are subjected to security inspections by the IUT and in addition, we offer packet manipulation operations to shape replayed traces. We discuss procedures that help verify the IUT's detection and prevention accuracy, attack coverage and behavior under diverse traffic patterns. Finally, we evaluate the strengths of our framework by mainly examining the open-source IPS Snort-Inline. IPS deficiencies revealed during testing help establish the effectiveness of our approach.

Research and practice on performance test system for IKE protocol

Research on Performance Testing of IKE Protocol

VPN Test System Based on IPSec Network Protocol

Design and Implementation of Network Layer Testing for IPTV Analyzer

SIP Authentication Mechanism and Its Performace Analysis

Implementation of IPSec IKE

IPsec Security Policy Oriented VPN Performance Evaluation Model

A Multi-tunnel VPN Concurrent System for New Generation Network Based on User Space

Interoperability Test Approach Based on ISM

Accelerating Implementation of IKEv2 by Using Security Coprocessor

Ml-Ike: A Multilayer Ike Protocol For Tcp Performance Enhancement In Wireless Networks

Research on IPSec Prameter Negotiation Process Based on IKE

Implementation and Performance Evaluation of IPSec VPN Based on Netfilter

Simulation Comparision of IKEv1 and IKEv2 Based on Linux

A Pragmatic Methodology for Testing Intrusion Prevention Systems

Detecting IKEv1 Man-in-the-Middle Attack with Message-RTT Analysis

Design and Realization of Evaluation Environment for Intrusion Detection Systems

The Design And Implementation Of Router Security Subsystem Based On Ipsec

From Active to Passive — Progress in Testing Internet Routing Protocols

Enhanced Reference Implementation Applied in Routing Protocol Test

Performance Testing of Mobile IPv6 Protocol