Abstract:Intrusion prevention systems (IPSs) not only attempt to detect attacks but also block malicious traffic and pro-actively tear down pertinent network connections. To effectively thwart attacks, IPSs have to operate both in real-time and inline fashion. This dual mode renders the design/implementation and more importantly the testing of IPSs a challenge. In this paper, we propose an IPS testing framework termed IPS Evaluator which consists of a trace-driven inline simulator-engine, mechanisms for generating and manipulating test cases, and a comprehensive series of test procedures. The engine features attacker and victim interfaces which bind to the external and internal ports of an IPS-under-testing (IUT). Our engine employs a bi-directional injection policy to ensure that replayed packets are subject to security inspection by the IUT before they are forwarded. Furthermore, the send-and-receive mechanism of our engine allows for the correlation of engine-replayed and IUT-forwarded packets as well as the verification of IUT actions on detected attacks. Using dynamic addressing and routing techniques, our framework rewrites both source and destination addresses for every replayed packet on-the-fly. In this way, replayed packets conform to the specific features of the IUT. We propose algorithms to partition attacker/victim-emanated packets so that they are subjected to security inspections by the IUT and in addition, we offer packet manipulation operations to shape replayed traces. We discuss procedures that help verify the IUT's detection and prevention accuracy, attack coverage and behavior under diverse traffic patterns. Finally, we evaluate the strengths of our framework by mainly examining the open-source IPS Snort-Inline. IPS deficiencies revealed during testing help establish the effectiveness of our approach.

Deployment of Intrusion Prevention System based on Software Defined Networking

Asidps: Auto-Scaling Intrusion Detection And Prevention System For Cloud

TPDD: A Two-Phase DDoS Detection System in Software-Defined Networking

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

Safe Reconfiguring Data Plane Via Supervision over Resource and Flow States

An Efficient Hybrid IDS Deployment Architecture for Multi-Hop Clustered Wireless Sensor Networks

Intrusion prevention with attack traceback and software-defined control plane for campus networks

SDN Oriented Software-Defined Security Architecture

An adaptive multistage intrusion detection and prevention system in software defined networking environment

Machine Learning-Based IDS for Software-Defined 5G Network

On the Deployment Strategy of Distributed Network Security Sensors

Design and Implementation of a Software-Defined Mobility Architecture for IP Networks

ID-Based SDN for the Internet of Things

Research on Distributed Intrusion Prevention System on High-Speed Networks

SDN-Based Intrusion Detection System for Early Detection and Mitigation of DDoS Attacks

A Comprehensive Survey of Distributed Denial of Service Detection and Mitigation Technologies in Software-Defined Network

A Pragmatic Methodology for Testing Intrusion Prevention Systems

A Testbed for Intelligent Software Defined Security Framework

Security Evaluation in Software-Defined Networks

SD-Access: Practical Experiences in Designing and Deploying Software Defined Enterprise Networks

Piggybacking Network Functions on SDN Reactive Routing: A Feasibility Study