From Intention to Practice: Towards Systematic Validation of NIDS Rule Enforcement
summary
NIDSFuzz reads deployed rules and converts signatures into buffer constraints to synthesize packets that guarantee semantic alignment with targets, then applies four tailored mutations — pass-through, obfuscation, repetition and blending — to expose normalization, performance and overlap bugs. Injection uses a tunable initiator/responder for controlled bidirectional traffic; alerts are port-aligned and fed to a differential checker across multiple NIDS. Evaluation on Snort3/Suricata/Snort2 finds over 10,000 enforcement issues across 18 categories, ~94% rule coverage, and fast generation/injection performance.
AI-written summary · about
chapters (13)
- 0:00Introduction to NIDS rules
- 3:32Problem and validation motivation
- 4:59Limitations of validation approaches
- 5:20Rule-based packet generation
- 6:27Mutation strategies for validation
- 8:19Bilateral traffic injection methods
- 9:43Alert alignment techniques
- 11:49System workflow design
- 12:55Evaluation setup and issues
- 14:41Rule enforcement examples
- 16:50Comparison with tools
- 17:57Performance evaluation
- 19:04Conclusion and future work
related talks
43mOpen Source Intelligence Based Intrusion Detection System
24mA Study on Intrusion Detection Systems with a Practical Experiment on Snort
11mIDFuzz: Intelligent Directed Grey-box Fuzzing
48mPutting an Intrusion Detection System to the Test
06mUsing Genetic Algorithms for Network Intrusion Detection and Integration into nProbe
45mAutomatic Discovery of Evasion Vulnerabilities Using Targeted Protocol Fuzzing
27mCatch Me If You Can: Hunting Misconfigurations Before They...
27mSpecification Mining for Intrusion Detection in Networked Control Systems