Asynchronous transfer mode (ATM) intrusion detection

Tarman, Thomas D.; Witzke, Edward L.; Bauer, Keith C.; Kellogg, B.R.; Young, William F.

doi:10.1109/milcom.2001.985769

Cited by 2 publications

(4 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The rule editor, which is described in more detail in [22], allows a user to specify event sequences in a graphical fashion, as shown in Figure 4. In this example, the rule "pnnidemo" is satisfied if a 'PNNI New Node" event is received, AND either "PNNI PGL Change" event is received.…”

Section: Rule Editormentioning

confidence: 99%

“…Hardware sensors are essentially high-speed cell or packet filters that operate at the signaling or line rates, typically OC-3 (155 Mbps) or OC-48 (2.488 Gbps). They function in the passive direct [22] fashion, siphoning off a copy of the bit stream and examining it for certain bit patterns, such as a specific message type on a certain virtual circuit. When a hardware sensor finds a cell (or having performed reassembly, a packet) that matches the specified criteria, it will generate a message for transmission to another system.…”

Section: Hardware-based Sensorsmentioning

confidence: 99%

“…This section describes ways to scale the SNIDE architecture described earlier to large networks, while providing rapid response. The issue of intrusion detection and mitigation in ATM networks poses a n important and unique challenge to which Sandia National Laboratories [22] has committed itself. Like any networking architecture, ATM networks consist of a number of ATM nodes distributed over a wide geographical area.…”

Section: Scaling Considerationsmentioning

confidence: 99%

“…For a comprehensive study, we plan to identify intrusionslattacks that are already known and ones that are conceptually feasible. As a first step, in addition to the types of intrusions enumerated in [22], the issues of detecting and mitigating the following attackslintrusions will be addressed in this effort.…”

Section: Scaling Considerationsmentioning

confidence: 99%

See 3 more Smart Citations

Final Report for the Intrusion Detection for Asynchronous Transfer Mode (ATM) Networks Laboratory Directed Research and Development Project

Tarman¹,

Witzke²,

Kellogg³

et al. 2001

View full text Add to dashboard Cite

Asynchronous Transfer Mode (ATM) is widely used as a backbone for corporate and public telephone and data networks, and its availability is paramount to the correct operation of the Internet Protocol (IP) and higher-layer applications. Key to the correct operation of ATM is its set of control plane protocols, which perform functions such as virtual circuit signaling and routing. If these protocols are attacked, then denial of service can result. Therefore, a system is required to monitor these control plane protocols, and respond if protocol events indicate a possible attack. Before this project, no system existed that performed Layer 2 (e.g., ATM, switched Ethernet, etc.) intrusion or misuse detection.ATM is a switched network technology, and other protocols (notably IP) are also being implemented in a switched fashion. Therefore, the general problem of intrusion detection in a switched network is receiving more attention. This paper describes in detail the Switched Network Intrusion DEtection (SNIDE) system that was developed under a Sandia Laboratory-Directed Research and Development project. This system was designed to perform control plane intrusion detection on a general switched network, and implemented to perform intrusion detection specifically on ATM networks. This system includes components that implement intrusion sensing, assessment, and response, along with management tools and graphical user interfaces to configure system components. Initial results have shown that this system operates as expected, and vendors have expressed interest in possible licensing of components from the SNIDE system.

show abstract

Section: Rule Editormentioning

confidence: 99%

Section: Hardware-based Sensorsmentioning

confidence: 99%

Section: Scaling Considerationsmentioning

confidence: 99%

Section: Scaling Considerationsmentioning

confidence: 99%

See 2 more Smart Citations