@article{ Handley01b,
  author = {Mark Handley and Vern Paxson},
  title = {Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics},
  journal = {Proceedings of the {USENIX} Security Symposium},
  year = {2001},
  annote = {The paper presents the problem with network intrusion detection systems, that it must keep the same state as the monitored receivers. An example of an attack is to use varying TTL's to make some packets reach the destination, while others dont. The NIDS then has difficulties of determining which packets are received by the destination host, and therefore has less chance of discovering an attack. The paper presents a technique known as traffic normalizing, i.e. packet header fields are normalized to safer values. All TTL's could be set to the maximum hop count in the internal network for example. For each of the IP header fields there is a discussion on potential misuse, how to normalize and the effects the change has on semantics. Also includes (without comments) an overview of UDP, TCP and ICMP normalizations.},
  url = {papers/handley01_norm-usenix-sec-01.pdf},
  submitter = {Stefan Alfredsson},
  bibdate = {Monday, August 19, 2002 at 08:27:40 (CEST)}
}

{"_id":"8yBX9M5GFkD8Xq6Fa","bibbaseid":"handley-paxson-networkintrusiondetectionevasiontrafficnormalizationandendtoendprotocolsemantics-2001","downloads":0,"creationDate":"2015-12-04T23:32:58.276Z","title":"Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics","author_short":["Handley, M.","Paxson, V."],"year":2001,"bibtype":"article","biburl":"http://www.cs.kau.se/cs/prtp/prtp.bib","bibdata":{"annote":"The paper presents the problem with network intrusion detection systems, that it must keep the same state as the monitored receivers. An example of an attack is to use varying TTL's to make some packets reach the destination, while others dont. The NIDS then has difficulties of determining which packets are received by the destination host, and therefore has less chance of discovering an attack. The paper presents a technique known as traffic normalizing, i.e. packet header fields are normalized to safer values. All TTL's could be set to the maximum hop count in the internal network for example. For each of the IP header fields there is a discussion on potential misuse, how to normalize and the effects the change has on semantics. Also includes (without comments) an overview of UDP, TCP and ICMP normalizations.","author":["Handley, Mark","Paxson, Vern"],"author_short":["Handley, M.","Paxson, V."],"bibdate":"Monday, August 19, 2002 at 08:27:40 (CEST)","bibtex":"@article{ Handley01b,\n author = {Mark Handley and Vern Paxson},\n title = {Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics},\n journal = {Proceedings of the {USENIX} Security Symposium},\n year = {2001},\n annote = {The paper presents the problem with network intrusion detection systems, that it must keep the same state as the monitored receivers. An example of an attack is to use varying TTL's to make some packets reach the destination, while others dont. The NIDS then has difficulties of determining which packets are received by the destination host, and therefore has less chance of discovering an attack. The paper presents a technique known as traffic normalizing, i.e. packet header fields are normalized to safer values. All TTL's could be set to the maximum hop count in the internal network for example. For each of the IP header fields there is a discussion on potential misuse, how to normalize and the effects the change has on semantics. Also includes (without comments) an overview of UDP, TCP and ICMP normalizations.},\n url = {papers/handley01_norm-usenix-sec-01.pdf},\n submitter = {Stefan Alfredsson},\n bibdate = {Monday, August 19, 2002 at 08:27:40 (CEST)}\n}","bibtype":"article","id":"Handley01b","journal":"Proceedings of the USENIX Security Symposium","key":"Handley01b","submitter":"Stefan Alfredsson","title":"Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics","type":"article","url":"papers/handley01_norm-usenix-sec-01.pdf","year":"2001","bibbaseid":"handley-paxson-networkintrusiondetectionevasiontrafficnormalizationandendtoendprotocolsemantics-2001","role":"author","urls":{"Paper":"http://www.cs.kau.se/cs/prtp/papers/handley01_norm-usenix-sec-01.pdf"},"downloads":0},"search_terms":["network","intrusion","detection","evasion","traffic","normalization","end","end","protocol","semantics","handley","paxson"],"keywords":[],"authorIDs":[],"dataSources":["6WGcSu2Ku7pZzqCcg"]}