@inproceedings{08838cedfd874f019281a05e40a8da49,
title = "On emulation-based network intrusion detection systems",
abstract = "Emulation-based network intrusion detection systems have been devised to detect the presence of shellcode in network traffic by trying to execute (portions of) the network packet payloads in an instrumented environment and checking the execution traces for signs of shellcode activity. Emulation-based network intrusion detection systems are regarded as a significant step forward with regards to traditional signature-based systems, as they allow detecting polymorphic (i.e., encrypted) shellcode. In this paper we investigate and test the actual effectiveness of emulation-based detection and show that the detection can be circumvented by employing a wide range of evasion techniques, exploiting weakness that are present at all three levels in the detection process. We draw the conclusion that current emulation-based systems have limitations that allow attackers to craft generic shellcode encoders able to circumvent their detection mechanisms. Keywords: Emulation; IDS; Shellcode; Evasion; Polymorphism",
author = "A. Abbasi and J. Wetzels and W. Bokslag and E. Zambon and S. Etalle",
year = "2014",
doi = "10.1007/978-3-319-11379-1_19",
language = "English",
isbn = "978-3-319-11378-4",
series = "Lecture Notes in Computer Science",
publisher = "Springer",
pages = "384--404",
editor = "A. Stavrou and H. Bos and G. Portokalidis",
booktitle = "Research in Attacks, Intrusions and Defenses (17th International Symposium, RAID 2014, Gothenburg, Sweden, September 17-19, 2014. Proceedings)",
address = "Germany",
note = "conference; 17th International Symposium on Research in Attacks, Intrusions and Defenses; 2014-09-17; 2014-09-19 ; Conference date: 17-09-2014 Through 19-09-2014",
}