Intrusion Detection Evasion Techniques and Case Studies

The number of security breaches is increasing significantly each year. Global Internet traffic is expected to be on the order of zettabytes for 2016 and then doubling by 2020. In addition to increased traffic, the percentage of attack traffic is also increasing. The sophistication of attacks is also increasing. Attacks range in complexity from simple protocol, insertion, or desynchronization attacks that exploit the vagueness and incompleteness of the RFCs to polymorphic blending attacks that camouflage attack and exfiltration traffic to match normal traffic for that particular network. Various evasion techniques have been described in articles within this field of study, but there has not been a collective discussion on the variety of evasion techniques. A comprehensive compilation of the most common evasion techniques is needed to aid Intrusion Detection System providers and to assist various decision makers as they determine how best to apply limited resources to protect assets. This paper is a case study analysis designed to detail the most common intrusion evasion techniques that exist in the wild today.