IDS/IPS SMB Named Pipe Reassembly for Intrusion Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional intrusion detection and prevention systems (IDS/IPS) are not sensitive to the unique methods of SMB packet reassembly and DCE/RPC fragment reassembly employed by different operating systems, leading to potential evasion of malicious traffic by attackers.
Innovation Solution
Implementing a processor-based system in IDS/IPS that uses reassembly tables to determine the kind of application target for SMB named pipes and DCE/RPC requests, ensuring valid packet inspection and reassembly that matches the target destination host's processing methods, including checking FID, UID, TID, MID, context ID, and operation number based on specific OS/application combinations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional IDS/IPS reassembles SMB packets and DCE/RPC fragments using standard methods, then the system structure remains simple, but the detection accuracy deteriorates because the reassembly may differ from the target destination host's method, allowing attackers to evade detection
Solution Approach 1:
The system changes the reassembly parameters based on the detected target destination host type. Different reassembly rules are applied for different host types (e.g., Windows vs. Samba), allowing the IDS/IPS to accurately reconstruct packets according to the specific target's behavior, thereby improving detection accuracy without using a single fixed method
Solution Approach 2:
The reassembly process is made dynamic by adapting to the target destination host type. The system automatically selects the appropriate reassembly method based on the target's operating system or application characteristics, enabling the IDS/IPS to maintain high detection accuracy across diverse network environments while managing complexity through automated adaptation
2Measurement precision
If the IDS/IPS implements target-based reassembly methods to match different OS/application combinations, then the detection accuracy improves, but the processing time increases due to additional validation and selection operations
Solution Approach 1:
The system performs preliminary identification of the target destination host type before the reassembly process. By classifying the target host (e.g., determining whether it's a Windows or Samba system) in advance, the IDS/IPS can pre-select the appropriate reassembly rules, avoiding the need to evaluate multiple reassembly methods during packet processing and thus reducing overall processing time while maintaining high accuracy
3Reliability
If the system inspects all packet fields thoroughly to ensure accurate reassembly, then the detection reliability improves, but the inspection complexity increases
Solution Approach 1:
The inspection process applies local quality by focusing validation efforts on specific packet fields that are most relevant to the target host type. For example, when dealing with Windows targets, the system prioritizes validation of Windows-specific fields, while for Samba targets, it focuses on Samba-specific validation rules. This targeted approach ensures high reliability by validating the most critical fields without unnecessarily inspecting all possible fields, thereby managing complexity
Data Source
AI summary
A method performed in a processor of an intrusion detection/prevention system (IDS/IPS) checks for valid packets in an SMB named pipe in a communication network. In a processor configured as an IDS/IPS, a packet in a transmission is received and a kind of application of a target of the packet is determined. Also, the data in the packet is inspected by the IDS/IPS as part of the SMB named pipe on only one of a condition that: (a) the FID in an SMB command header of the packet is valid (i) for segments/fragments in the SMB named pipe and (ii) for the determined kind of application of the target of the packet, as indicated by a reassembly table, and (b) the determined kind of application of the target of the packet does not check the FID, as indicated by the reassembly table.