Alert Flooding Attack on Snort and Its Mitigation Introduction

Network Intrusion Systems employ a number of sensors for efficient reporting of attacks on the hosts in a network. But a serious problem with these sensors is that the information they produce is in a low level format and the system administrator gains no useful information from the report. In this report I am going to discuss about the usage of a method to correlate the alerts produced, the attack graph method. The subject matter of this report though will be about the discussion of a type of attack on NIDS called 'alert flooding'. The first effect of this attack is the loss of service. The sensors do not do the intended job. The second effect is that we get lot of unintended alerts which make alert correlation impossible or at least makes correlation meaningless. The report will walk through the basics of NIDS, the operation of Snort, establishing alert flooding attack and solution to mitigate it using two concepts called Token Bucket Filter and Queue Graph.