![](bg3.png)
Slow scans that fool the frequency checks of IDS
by slowing down packets, method matching that uses
alternate HTTP commands for detecting CGI scripts
and premature request ending with malicious data
hidden in headers are also evasion attacks frequently
performed against the IDS (Martin, 2019).
Denial-of-service attacks have also been used for
evading intrusion detection (Cheng et al., 2012) (Mar-
tin, 2019). These attacks try to overflow the net-
work connection or the IDS system’s resources to
slow down rule matching or pattern recognition (Ig-
ure and Williams, 2008).
The evasion attack that is most similar to our ap-
proach is payload mutation. In this technique, at-
tackers transform malicious packets to semantically
equivalent that look different from malicious packet
signatures (e.g. transformation of URI hexadecimal
encoding, self-reference directories etc. in payloads)
(Martin, 2019). Still, the aforementioned evasion at-
tacks only work under certain cases and not in ev-
ery situation (Cheng et al., 2012; Niemi et al., 2012).
Contrary to this, we tested our approach against nu-
merous, diverse types of security systems that imple-
ment different detection mechanisms (IDS, host end-
point security systems). Results show none of the
tested systems could either detect the malicious con-
nection or data and commands transferred over the
network.
2.2 Malicious Activity and Data
Leakage Detection Techniques
Most common host endpoint security mechanisms in-
volve host intrusion detection systems (host IDS), an-
tivirus and security solutions that utilize a range of
techniques. From simple signature analysis and API
call monitoring, sandboxing to more advanced de-
tection mechanisms like packet caching, flow mod-
ification (Handley et al., 2001), active mapping
(Shankar and Paxson, 2003) and policy enforcement
(Marpaung et al., 2012; Cheng et al., 2012). The state
of the art now also considers heuristics with machine
learning.
Modern network security solutions use session
packet heuristic analysis, deep packet inspection and
session trends (like packets per min) along with botnet
architectures to detect malicious activity in networks
(Livadas et al., 2006; Binkley and Singh, 2006). Oth-
ers rely on statistical analysis for classifying vari-
ous types of traffic (Crotti, 2007), session reassembly
(Martin, 2019) to detect splicing and sandboxing.
Some solutions use machine learning to detect
malicious network activity. In (Lakhina et al., 2004)
and (Stergiopoulos et al., 2018), researchers try var-
ious packet features to extract information from the
physical aspects of the network traffic. Authors in
(Prasse, 2017) use malicious HTTPS traffic to train
neural networks and sequence classification to build a
system capable of detecting malware traffic over en-
crypted connections. Other approaches focus on iden-
tifying target malware/botnet servers (Lokoc et al.,
2016) or web servers contacted (Kohout and Pevny,
2015), instead of understanding malicious traffic of
various types. Authors in (Gu et al., 2007) and (Yen
and Reiter, 2008) use signal-processing techniques
like Principal Component Analysis to aggregate traf-
fic and detect anomalous changes flows. Lakhina et
al. (Lakhina et al., 2004) modelled network flows
as combinations of eigenflows to distinguish between
short-lived traffic bursts, trends, noise, or normal traf-
fic. Terrell et al. (Terrell, 2005) grouped network
traces into time-series and selected features, such as
the entropy of the packet and port numbers, to detect
traffic anomalies.
Concerning data leakage, authors in (Tahboub and
Saleh, 2014) surveyed DLP systems and described ex-
isting technologies for data protection, such as ID-
S/IPS, Firewalls, etc. that are using Deep Packet
Inspection (DPI) architecture. They compared them
to the DLP systems that use Deep Content Inspec-
tion (DCI) and showed how the latter are more ef-
ficient on detecting potential data breaches. Authors
in (W”uchner and Pretschner, ) presented a DLP solu-
tion based on Windows API function calls using func-
tion call interposition. In (Borders and Prakash, ), re-
searchers introduced an approach for quantifying in-
formation leaks in web traffic using measurement al-
gorithms for the HTTP (Hypertext Transfer Protocol)
protocol to isolate not legitimate outgoing activity.
While all aforementioned network detection and
data leakage prevention approaches are based on
models of malware behavior (not unlike signature-
based intrusion detection), our approach uses com-
pletely different packets. This way, we can avoid de-
tection by (a) not having to hide malicious informa-
tion and (b) by introducing all types of payloads from
different legitimate sessions in our malicious stream,
thus data transferred cannot be assigned to a partic-
ular distribution nor can be analyzed based on static
features.
2.3 Covert Channels and
Steganography
The bit-mask is like a symmetrical encryption key. Its
values are bit position pointers that need to be shared
between the code running at the victim’s and at-
tacker’s system prior to execution. If a mask is agreed
SECRYPT 2020 - 17th International Conference on Security and Cryptography
54