ABSTRACT
This work describes the design and implementation of protocol scrubbers. Protocol scrubbers are transparent, active interposition mechanisms for explicitly removing network scans and attacks at various protocol layers. The transport scrubber supports downstream passive network-based intrusion detection systems by converting ambiguous network flows into well-behaved flows that are unequivocally interpreted by all downstream end-points. The fingerprint scrubber restricts an attacker's ability to determine the operating system of a protected host. As an example, this paper presents the implementation of a TCP scrubber that eliminates insertion and evasion attacks - attacks that use ambiguities to subvert detection - on passive network-based intrusion detection systems, while preserving high performance. The TCP scrubber is based on a novel, simplified state machine that performs in a fast and scalable manner. The fingerprint scrubber is built upon the TCP scrubber and removes additional ambiguities from flows that can reveal implementation-specific details about a host's operating system
TABLE OF CONTENTS
TITLE PAGE
CERTIFICATION
DEDICATION
ACKNOWLEDGEMENT
ABSTRACT
TABLE OF CONTENTS
CHAPTER ONE
INTRODUCTION
1.1 BACKGROUND OF THE STUDY
1.2 STATE OF THE PROBLEM
1.3 PURPOSE OF THE STUDY
1.4 AIMS AND OBJECTIVES
1.5 SCOPE OF STUDY
1.6 LIMITATIONS OF STUDY
1.7 ASSUMPTIONS
1.8 DEFINITION OF TERMS
CHAPTER TWO
LITERATURE REVIEW
CHAPTER THREE
3.1 DESCRIPTION AND ANALYSIS OF EXISTING SYSTEM
3.2 FACT FINDING METHOD USED
3.3 ORGANIZATION STRUCTURE
3.4 OBJECTIVES OF EXISTING SYSTEM
3.5 INPUT, PROCESS AND OUTPUT ANALYSIS
3.6 INFORMATION FLOW DIAGRAMS
3.7 PROBLEMS OF THE EXISTING SYSTEM
3.8 JUSTIFICATION OF THE NEW SYSTEM
CHAPTER FOUR
4.1 DESIGN OF THE NEW SYSTEM
4.2 INPUT SPECIFICATION AND DESIGN
4.3 OUTPUT SPECIFICATION AND DESIGN
4.4 FILE DESIGN
4.5 PROCEDURE CHART
4.6 SYSTEM FLOW CHART
4.6.1 SYSTEM REQUIREMENTS
4.7 IMPLEMENTATION
4.7.1 PROGRAM DESIGN
4.7.2 PROGRAM FLOWCHART
4.7.3 PSEUDO CODE
4.7.4 SOURCE PROGRAM: TEST RUN
CHAPTER FIVE
5.0 DOCUMENTATION
5.1 RECOMMENDATION
5.2 CONCLUSION
BIBLIOGRAPHY
