Specification-Based Intrusion Detection System for Carrier Ethernet

Abstract

Layered network architectures (OSI, TCP/IP) separate functionality in layers, allowing them to be designed and implemented independently. However, from the security point of view, once a lower layer is compromised, the reliability of the higher layers can be impaired. This paper is about the security of the Data Link Layer, which can affect the reliability of higher layers, like TCP, HTTP and other WorldWide Web protocols. The paper analyzes security-wise a layer 2 protocol-the Spanning Tree Protocol (STP), part of the Ethernet suite-and presents a solution to detect attacks against this protocol using Specification-based Intrusion Detection.