The Center for Education and Research in Information Assurance and Security (CERIAS)

The Center for Education and Research in
Information Assurance and Security (CERIAS)

Reports and Papers Archive


Browse All Papers »       Submit A Paper »

A Pattern Matching Model For Misuse Intrusion Detection

COAST TR 95-06
Kumar, S., Spafford, E.
Download: PDF
Added 1900-01-01

Applying Genetic Programming to Intrusion Detection

COAST TR 95-05
Crosbie, M., Spafford, E.
Added 1900-01-01

A Software Architecture to Support Misuse Intrusion Detection

COAST TR 95-04
Kumar, S., Spafford, E.
Download: PDF
Added 1900-01-01


Support For Security In Distributed Systems Using Messiahs

COAST TR 94-10
Chapin, S., Spafford, E.
Download: PDF
Added 1900-01-01

Constructing Distributed Schedulers Using the MESSIAHS Language

COAST TR 94-09
Chapin, S., Spafford, E.
Download: PDF
Added 1900-01-01

Authorship analysis: identifying the author of a program

COAST TR 94-08
Krsul, I.
Download: PDF
Added 1900-01-01

An Application of Pattern Matching in Intrusion Detection

COAST TR 94-07
Kumar, S., Spafford, E.
Download: PDF
Added 1900-01-01

Countering Abuse of Name-Based Authentication

COAST TR 94-06
Schuba, C., Spafford, E.
Download: PDF
Added 1900-01-01

Addressing Weaknesses in the Domain Name System Protocol

COAST TR 94-05
Schuba, C.
Download: PDF

The Domain name System (DNS) is a widely implemented distributed database system used throughout the Internet, providing name resolution between host names and Internet Protocol addresses. This thesis describes problems with the DNS and one of its implementations that allow the abuse of name based authentication.  This leads to situations where the name resolution process cannot be trusted, and security may be compromised. This thesis outlines the current design and implementation of the DNS.  It states the main problem both on a high level and as applied to the DNS in a more concrete fashion.  We examine the weaknesses by describing the necessary modifications in authoritative DNS data and Domain Name System code.  We list experiences gained during experiments with several setups of name servers and trusting hosts in a local area network. Too weak assumptions during the authentication processes cause many security breaches.  We state the security considerations in the official design documents and analyze the algorithms used in the DNS protocol looking for weak assumptions.  Using a wide variety of criteria, we discuss several approaches to solve the main problem in the Domain name System protocol.  Two of these solutions, hardening the name server and using cryptographic methods for strong authentication, receive more attention than the other solutions.

Added 1900-01-01

Writing, Supporting, and Evaluating Tripwire: A Publically Available Security Tool

COAST TR 94-04
Kim, G., Spafford, E.
Download: PDF
Added 1900-01-01

Experiences with Tripwire: Using Integrity Checkers for Intrusion Detection

COAST TR 94-03
Kim, G., Spafford, E.
Download: PDF
Added 1900-01-01

Computer Viruses as Artificial Life

COAST TR 94-02
Spafford, E.
Download: PDF
Added 1900-01-01

Monitoring File System Integrity with Tripwire

COAST TR 93-02
Kim, G., Spafford, E
Download: PDF
Added 1900-01-01

The Design and Implementation of Tripwire: A System Integrity Checker

COAST TR 93-01
Kim, G., Spafford, E.
Download: PDF
Added 1900-01-01