Re: Evasion schemes or techniques

[Jose Nazario <jose () monkey org>]

On Sun, 10 Dec 2006, kassem.nasser () gmail com wrote:

> I am interested in knowing evasion schemes for application based 
> invasions available, and i appreciate if you can guide me to some papers 
> or links where I can find such information, and where to look for 
> answers about evasion techniques, many thanks,

ptacek and newsham, "insertion, evasion, and denial of service: Eluding. 
Network Intrusion Detection" and anything that cites that. names to look 
for include vern paxson, roesch, Lippmann, and many others. simply looking 
for that paper in google scholar yields dozens of citations and 
extensions.

fan out from that, fan backwards from that, and you'll learn a great deal. 
it's one of the best starting points in this question.

________
jose nazario, ph.d.                 jose () monkey org
http://monkey.org/~jose/            http://monkey.org/~jose/secnews.html
                                    http://www.wormblog.com/

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------