No abstract

Asynchronous Transfer Mode (ATM) is widely used as a backbone for corporate and public telephone and data networks, and its availability is paramount to the correct operation of the Internet Protocol (IP) and higher-layer applications. Key to the correct operation of ATM is its set of control plane protocols, which perform functions such as virtual circuit signaling and routing. If these protocols are attacked, then denial of service can result. Therefore, a system is required to monitor these control plane protocols, and respond if protocol events indicate a possible attack. Before this project, no system existed that performed Layer 2 (e.g., ATM, switched Ethernet, etc.) intrusion or misuse detection.ATM is a switched network technology, and other protocols (notably IP) are also being implemented in a switched fashion. Therefore, the general problem of intrusion detection in a switched network is receiving more attention. This paper describes in detail the Switched Network Intrusion DEtection (SNIDE) system that was developed under a Sandia Laboratory-Directed Research and Development project. This system was designed to perform control plane intrusion detection on a general switched network, and implemented to perform intrusion detection specifically on ATM networks. This system includes components that implement intrusion sensing, assessment, and response, along with management tools and graphical user interfaces to configure system components. Initial results have shown that this system operates as expected, and vendors have expressed interest in possible licensing of components from the SNIDE system.