Computer-based activities are now subject to electronic vandalism. A vandal, who is sometimes called a hacker in this context, may attempt to intrude upon a computer system in order to steal information in an act of industrial espionage, or to alter records to the detriment or the benefit of another party's interests or reputation, or to impede the operation of the computer by implanting a virus or by flooding the computer with bogus information.
Computers are often protected against vandals' intrusions by intrusion detection systems. An intrusion detection system monitors the activities of users and would-be users for particular events or patterns of events generally known as signatures. A signature is a set of events and transition functions that define a sequence of actions that constitute misuse or unauthorized use of the computer. For example, a misuse engine that relies upon signature monitoring is described in detail in U.S. Pat. No. 5,557,742.
More specifically, a signature may include a signature event such as a particular pattern of bits. For example, the pattern may identify an incoming message that is designed to induce a deliberate violation of a communication protocol, where the kind of violation may be indicative of a malicious attack. Associated with a signature event there may be a signature event counter for counting the number of times the signature event occurs. Associated with the signature event and the signature event counter there may be a signature threshold that may be used to differentiate between attempted intrusions and uneventful occurrences of the signature event. For example, the signature event may be required to occur J times in K minutes before an intrusion is suspected. Thus, for example, more than five occurrences in twenty minutes of the signature event “protocol violation 3” may be used as an indicator that an unauthorized party may be attempting to intrude upon the operation of the protected computer.
An alert is generated when the intrusion detection system observes activity that is suggestive of an intrusion. The purpose of the alert is to inform a network administrator of the suspected attack, so that the administrator may take action to minimize the damage done by the intruder. Often, alerts from a number of intrusion detection sensors may be sent through an intrusion detection server that functions as an intermediary between the sensors and the network administrator. An unfortunate consequence of this architecture is that the intrusion detection server may impose an upper bound on the performance of the intrusion detection system.
This bound becomes critical when a vandal or hacker attacks a target such as an Internet web server by flooding the target with a torrential flow of disruptive messages that overload the target to the point of functional failure. Attacks of this kind are called “denial of service” attacks. During a denial of service attack, the vandal may fraudulently assume a number of different electronic identities, often by including messages in the disruptive flow that have a variety of source addresses. Such a vandal may be called a spoofer.
In one kind of denial-of-service attack, a spoofer may send the target a large number of Internet Control Message Protocol (ICMP) messages called Packet INternet Gropers (PINGS), which are normally used to query whether a particular Internet address is accessible to the sender. Upon receiving a PING, the target responds to the spoofed device rather than the vandal, as the PING bears the fraudulently used identity of the spoofed device. By flooding the target with PINGS, the vandal may divert the target's resources to generating responses and consequently away from its legitimate tasks, and may also cause unproductive network congestion by triggering a flood of response messages.
In another kind of denial-of-service attack, the vandal may send the target a large number of TCP SYN messages. A TCP SYN message is normally used to initiate a TCP connection. Upon receiving a SYN massage, the target sends a SYN/ACK message to the spoofed device rather than the vandal, as the SYN message bears the fraudulently used identity of the spoofed device. Further, the target reserves an internal data structure presumably to be used in supporting a connection with the spoofed device. So, by flooding the target with a large number of SYN messages, the vandal causes not only the problems mentioned above—resource diversion and network congestion—but also exhausts the target's capacity to support the data structures needed to establish other connections. Thus, the target is left unable to establish connections with any device except the spoofed device.
To combat such attacks, a computer may rely upon protective equipment that filters incoming messages according to information provided by the intrusion detection system. The intrusion detection system's intrusion detection sensors detect the onslaught of a vandal's attack, read the source addresses or other markings that the vandal usurps and fraudulently re-uses, and sends out alerts, through the intrusion detection server, intended to inform the network administrator of the attack. The administrator may then configure the filtering equipment to block incoming messages that seem to originate from the malicious source.
When a typical denial-of-service attack involves an onslaught of incoming messages, the intrusion detection sensors produce an intense outpouring of alerts, which are typically funneled through the intrusion detection server for correlation on behalf of the network administrator. Due to the intensity of the flow of alerts, the intrusion detection server may itself become overwhelmed. As a result, the intrusion detection system may fail when it is most critically needed, or queues and delays may result that prevent the server or the administrator from receiving crucial information in a timely way. Consequently, the capability of the intrusion detection system to defend against a denial-of-service attack is significantly limited.
Thus there is a need for improving the operation of an intrusion detection system, so that it may provide a stronger and more reliable defense against denial-of-service attacks by vandals intended to overwhelm both the protected device and the intrusion detection system itself by flooding them with a torrent of disruptive inbound messages.