Simulating Concurrent Intrusions for Testing Intrusion Detection Systems: Parallelizing Intrusions

For testing Intrusion Detection Systems (IDS), it is essential that we be able to simulate intrusions in diierent forms (both sequential and parallelized) in order to comprehensively test and evaluate the detection capability of an IDS. This paper presents an algorithm for automatically transforming a sequential intrusive script into a set of parallel intrusive scripts (formed by a group of parallel threads) which simulate a concurrent intrusion. The main goal of parallelizing an intrusion is to distract an IDS's attention away from the intrusive activity. We identify constraints on the execution order among commands, and the way commands can be classiied based on the eeect of their execution. Synchronization and communication mechanisms are used to guarantee that the execution order among commands is preserved even under the paral-lelized scenario. We show that, experimentally, our work constitutes a major part of testing the ability of an IDS to detect intrusions and is especially useful for the users and developers of IDSs. We show that an intrusion is less likely to be detected if the suspicious activity is distributed over several sessions. Finally, we discuss some aspects of parallelizing intrusive scripts, including some practical diiculties that are open problems for future research.