Statistical Anomaly Detection for Link-State Routing Protocols

The JiNao project at MCNC/NCSU focuses on detecting intrusions, especially insider attacks, against OSPF (Open Shortest Path First) routing protocol. This paper presents the implementation and experiments of the JiNao's statistical intrusion detection module. Our implementation is based upon the algorithm developed in SRI's NIDES (Next-generation Intrusion Detection Expert System) project. Some modifications and improvements to NIDES/STAT are made for a more effective implementation in our environment. Also, three OSPF insider attacks (e.g., maxseq, maxage, and seq++ attacks) have been developed for evaluating the efficacy of detecting capability. The experiments were conducted on two different network routing testbeds. The results indicate that the proposed statisticalmechanism is very effective in detectingthese routing protocol attacks.

• Type: Conference
• Year: 1998
• Where: ICNP
• Authors: D. Qu, Brain Vetter, Feiyi Wang, R. Narayan, Shyhtsun Felix Wu, Y. Frank Jou, Fengmin Gong, C. Sargor
• Keywords: Computer Networks, ICNP 1998, Insider Attacks, Intrusion Detection, Routing Protocol