Towards Illuminating a Censorship Monitor’s Model to Facilitate Evasion
Sheharbano Khattak∗ Mobin Javed† Philip D. Anderson∗ Vern Paxson† ∗Independent researcher †U.C. Berkeley International Computer Science Institute
Abstract We focus our effort on one widely used technology for censorship systems, an on-path network monitor that Censorship systems that make dynamic blocking decisions passively observes network traffic and effects censorship must inspect network activity on-the-fly to identify content to disruption by packet injection (e.g., forged RSTs or DNS filter. By inferring the analysis models of such monitors we can replies). These systems, which we will refer to simply as identify their vulnerabilities to different forms of evasions that monitors, afford more scalability than in-path elements we can then exploit for circumvention. We leverage the obser- that forward traffic (and can directly manipulate it), and vation that censorship monitors essentially work on the same this technology underlies much of the functionality used principles as Network Intrusion Detection Systems (NIDS) and by the Great Firewall of China (GFW). therefore inherit the same evasion vulnerabilities already dis- Particularly significant for our purposes, from a cussed in the NIDS context for years. Using this past work technical perspective such monitors function in the as a guide, we illustrate the power of illuminating a monitor’s same manner as Network Intrusion Detection Systems analysis model by conducting extensive probing to test for vul- (NIDS)—and for well over a decade researchers have nerabilities in the Great Firewall of China. We find exploitable studied the problem of the many ways that the analysis flaws in its TCB creation and destruction, fragment and seg- model of a NIDS renders it vulnerable to evasions, some ment reassembly, packet validation, (in)completeness of HTTP very difficult to remedy [15] without requiring some analysis, and state management. form of in-line operation [11]. Potential monitor models span a wide range of basic architectures: simple stateless 1. Introduction packet inspection; stateful but incomplete (lacking full Any censorship system that makes dynamic blocking protocol coverage); complete for a single set of imple- decisions will employ a particular analysis model for mentation choices (such as how to resolve ambiguities); dynamically inspecting activity. More powerful mod- or assessing multiple possible implementation choices in els enable more accurate decisions while also resisting parallel. In addition, stateful approaches must make de- attempts by users to evade detection; but such models cisions regarding state management that can render them present the censor with costly tradeoffs in terms of ease vulnerable to either state exhaustion attacks or manipu- of implementation and scalability of performance versus lation of state-holding to subvert the monitor’s analysis the richness of analysis that a given model provides. In capabilities. All of these present evasion opportunities. general, users can attempt to shape their network traffic To explore this space, we perform extensive probing in various ways so that the censor’s system fails to ac- of the GFW monitor. We treat it as a black-box that curately identify activity the censor wishes to suppress. given HTTP/TCP/IP traffic provides indications of posi- Such anti-censorship evasions can then spur an “arms tive censorship decisions in terms of producing spoofed 1 race” in which the censor modifies their system to plug TCP RST packets (we leave analysis of its other com- holes in its coverage. ponents, such as poisoning of DNS/UDP/IP traffic, for We premise our work on the observation that if we can future work). In particular, we employ HTTP requests illuminate the model used by a censorship system, we 1 can identify classes of evasions that can elude its control: As noted in prior work [20], we confirmed that in particu- lar it sends 3 spoofed RSTs with varying gaps between their ways that users can alter network traffic that will both sequence numbers. After this disruption, a ≈ 90 sec blocking avoid detection and, crucially, require the censor to make period bars any communication from the client to server on the expensive changes to the system’s basic model to remedy. given server port [2].
1 that selectively contain banned keywords or hostnames GFW updates. brdgrd [21] leverages GFW’s lack of along with varying forms of traffic permutation in order TCP segment reassembly for TLS negotiations to evade to map out a model of how GFW’s analysis works, in- the detection of Tor Bridges via active scanning. cluding its state management. As we make observations Effort (a) of WestChamber has the most relevance for of its structural vulnerabilities, we confirm the viability our work, which concerns crafting traffic in such a fash- of the corresponding evasions by employing them to re- ion that GFW will not be triggered at all. In general, our trieve banned content. efforts aim to foster the development of similar evasion We find that GFW performs stateful analysis of the tools in the specific context of on-path monitoring. client side of HTTP streams, but not the server side. It lacks certain low-level protocol coverage such as val- 3. Methodology idating checksums that renders it vulnerable to misdi- rection, but which the implementors can easily fix. It We deduce GFW’s analysis model by treating it as a also suffers from deeper problems, including vulnera- black box and using scapy [7] to actively probe it with bilities to ambiguities due to overlapping IP fragments specially crafted packets, some of which include a trig- and TCP segments; TCB manipulation via TTL-limited gering keyword. Observing GFW responding to such SYN, FIN or RST packets; limited analysis of pipelined packets indicates its processing enabled it to observe the HTTP requests and URL encodings; and state manage- keywords in context; a lack of response indicates a fail- ment that will retain state for extensive periods of time ure of its analysis model to make such an observation. (hours) but will discard state in lieu of very modest TCP Accurate design of our probe tests involves determin- bytestream buffering (1KB). We confirmed numerous ing whether GFW is stateful (confirmed in §5) and at evasions due to monitor’s limited semantic model, illus- which stage of packet/stream processing it triggers. For trating the power of conducting such an exploration. We the latter, we probed it placing a censored keyword in aim in follow-on work to then develop anti-censorship an IP fragment, full IP packet, TCP segment, incomplete tools based on these findings. HTTP request, and full HTTP request (with and without accompanying HTTP response). We find that GFW only censors HTTP requests containing a sensitive keyword. 2. Related Work This result confirms that filtering on HTTP response has likely discontinued [13]. Consequently, we always send Numerous efforts have examined the operation of probes with at least one complete HTTP request. GFW [6,8,9,13], finding it uses NIDS-like functionality Experimental Setup. We use two machines for our to match sensitive keywords and terminates TCP connec- evaluation, a client in China and an Apache webserver tions by injecting RST packets. The authors of [13] find in USA. In reality a nation-wide censorship system like that GFW rarely filters HTTP responses, and apparently GFW surely comprises multiple heterogeneous moni- ceased so entirely between Aug. 2008 and Jan. 2009. tors, but our use of a single network path means we Evasion attacks on NIDS [11, 15, 17] have been should generally encounter the same particular compo- studied for more than a decade, and a number nents. Using the traceroute-based technique described of tools (fragroute [18], sniffjoke [1] and by Xu et al. [23] we confirmed that we always encoun- idsprobe [12]) implement these techniques. However, tered the same GFW IP address, though our activity may evasion attacks have only recently received attention by have triggered additional filtering devices along the path. anti-censorship efforts. Clayton et al.’s study found that Soundness. To ascertain the integrity of our tests and discarding the RST packets a censor injects protects ef- the insights consequently obtained, we must ensure that fectively against keyword-based censorship [8]. This cir- (i) our tests work as intended, and (ii) we accurately iden- cumvention technique, however, does not provide full tify RST packets injected by GFW. For the former, we “evasion” because the censor has already noticed the ac- first carry out all the tests locally without GFW in the tivity and may employ other steps (e.g., IP blocking) to picture, giving us a baseline against which to compare suppress further activity. It also requires both client-side and contrast GFW’s inferred analysis model. For the lat- and server-side changes, and impairs the intended use of ter, we capture traces at both client and server, which en- RSTs for terminating connections for benign reasons. ables us to accurately detect GFW-injected RST packets WestChamber is a community research effort by a by observing RSTs at the receiver not sent by the sender. group of Chinese netizens [3–5]. It uses two approaches to evade GFW injection: (a) each end host sends a RST 4. Model Elements to Probe packet to fool GFW into viewing the connection as ter- minated, and (b) the client drops DNS replies injected In this section we frame design considerations for by GFW based on fingerprint signatures. The authors stateful monitors and the corresponding probe tests we caution that their techniques can fail in the future due to can use to infer their analysis models. We categorize the
2 sistent HTTP connections over which we introduce in- creasing amounts of time and volume of non-sensitive data prior to sending a sensitive request. In addition, a monitor may time out connections with holes (pending undelivered data) using a different policy, which we can probe in an analogous manner. TCB Teardown. Similarly, a monitor must decide when to stop maintaining any information about a con- Figure 1: Terminology for overlapping fragments: (a) Frag 1 and Frag 2 nection. Normally it makes sense to do so upon observ- are original fragments, while the others are subsequent fragments w.r.t. ing one side transmit a RST, or both engage in a FIN arrival time. (b) Frag 3 is left-long to Frag 1, Frag 4 is left-short, while handshake. However, connections can also cease due Frag 2 and 5 are left-equal. (c) Frag 3 is right-short to Frag 1, Frag 4 is right-long, and Frag 2 and Frag 5 are right-equal. (d) Frag 3 and to other reasons, such as a loss of network connectiv- Frag 4 partially overlap Frag 1, while Frag 5 fully overlaps Frag 2. ity, for which the monitor must ultimately recover using (e) Offsets 6 and 7 represent a hole. a timeout, the choice of which will necessarily trade off in-depth analysis versus available resources. We can infer a monitor’s teardown policy by estab- design decisions into TCB creation, reassembly (pack- lishing a connection, transmitting a termination message ets/bytestream), TCB teardown, state management, and crafted so that the intended receiver will ignore them, and protocol message interpretation. We base our probe tests then subsequently attempting to access censored content. largely upon prior techniques [11, 15]. Success for the latter indicates the monitor tore down the TCB Creation. Stateful analysis of TCP requires that TCB in response to the termination message. a monitor uses some criteria to determine when to instan- Protocol Message Interpretation. In addition to con- tiate state, i.e., a Transmission Control Block (TCB) for nection management and recovery of data, a basic mon- TCP connections. The monitor can do so upon observa- itor analysis issue concerns correct and full interpreta- tion of a proper three-way handshake, but can also do so tion of the meaning of various messages. Here, im- based on more partial observation. plementation shortcomings can result in failures to val- To infer a stateful monitor’s TCB creation policy, we idate values for different header fields (particularly true can test (i) an initial SYN but no responding SYN-ACK, of edge cases), but more fundamentally the monitor’s job (ii) a SYN-ACK but no initial SYN, or (iii) both SYNs. becomes difficult in the face of messages that diverge After each we send a packet with banned content (its from the protocol specification. For lower-layer proto- ACK completes the handshake) and see whether we ob- cols exploiting such deficiencies can prove difficult (e.g., serve disruption, indicating that the monitor has tracked a packet with bad IP header checksum will be dropped the connection and thus presumably instantiated a TCB. before even reaching the monitor), but more opportuni- Reassembly. To fully recover application data, a mon- ties arise at higher layers—particularly, for our purposes, itor must reassemble fragmented packets as well as re- when considering HTTP messages. cover the TCP bytestream. In addition, overlapping frag- Even given full, correct implementation, monitors face ments or TCP segments that differ in their contents ren- difficult analysis decisions due to incomplete informa- der the correct reassembly ambiguous. If the monitor tion. For example, by itself a monitor will have sig- uses a different interpretation than the receiver, opportu- nificant problems determining whether a given packet’s nities for evasion arise. IP TTL suffices for delivery of the packet to the re- Figure1 shows our terminology for discussing re- ceiver. Prior work has shown that a monitor can resolve assembly overlap. We test each of the 18 possible over- many protocol-based ambiguities by observing an end lap cases that can arise to see how the monitor acts to machine’s response to special probes that comprehen- resolve the ambiguous overlap, i.e., whether it reacts to sively explore a protocol in all perceivable contexts [17]. a censored keyword that appears only in one version of Given limited space we do not explore this approach the overlap. The same approach applies for reassembly comprehensively, but in the next section present a sub- of both IP fragments and overlapping TCP segments. set that reflects the most significant aspects. State Management. Due to resource constraints, any stateful monitor must define a policy for ultimately dis- 5. Illuminating GFW’s Analysis Model carding state (for long-running connections), typically framed in terms of how long and/or how much state to We now turn to using the probe tests identified in the keep. Inducing the monitor to discard state can then last section to deduce GFW’s analysis model. While we open up an evasion opportunity. We can infer a mon- conducted 40+ such tests, due to limited space here we itor’s state-holding capabilities and policies using per- only report tests leading to interesting observations.
3 Notation. For unambiguous presentation of our re- Figure1 (IP2). For reassembly of overlapping TCP seg- sults, we introduce notation (inspired by [20]) as follows. ments, we find that if a subsequent left-equal segment ar- We denote the temporal sequence of packets sent by the rives, GFW prefers it (TCP5). For all other cases, GFW client and the web sever as (pi, pi+1, ..., pm) and (p j, does not react to any keyword placement, enabling us to p j+1, ..., pn), respectively. We represent packet(s) in- successfully retrieve the censored content. jected by GFW to the client and server by g and g (we State management. We find that GFW maintains omit the number of such packets when repeated), and the state for a connection for as long as 10 hours (TCP7), shorthand reset refers to (g,g). We capture a packet’s and for as much as 1 GB data transferred from client TCP flags using superscripts—for example, pFA means to server (TCP8). (Note, these values correspond to the with FIN and ACK set—and optional flags with paren- maxima we tested, rather than precise thresholds. We ob- theses, such as pR(F) for a RST with or without FIN. We tained consistent results over repeated measurements for prefix a flag with negation ¬ to indicate that it is not set. the values listed, but the boundaries used at a given time p(D) refers to a data packet, for D ∈ {Bad,Good}, could depend on the monitor’s operational load.) meaning carrying a censored keyword or not. We rep- We repeated these tests but with a preceding hole, find- resent back-to-back data packets collectively carrying ing that GFW abandons state more readily, doing so af- data D as p(D)+ and D’s total size by δ(D). seq(p) ter having to buffer 1KB of data above the hole (TCP9). and ack(p) represent p’s TCP sequence and ack. num- Likewise, GFW purges state after 60–90 minutes elapses bers. τ(t) refers to the passage of t units of time, and for a connection that includes a hole (TCP10). tuple(p) represents the connection 5-tuple of a packet TCB Teardown. To identify GFW’s TCB teardown p. Hole refers to one or more missing data packets policy (TCP6a), we send pR(A) and (separately) pF(A) for which packets later in the sequence space have ar- from client to server. GFW’s acceptance of these al- rived. The predicate abovehole(p) expresses a packet lows us to force TCB teardown (for example, using in- p for which seq(p) falls within the advertised window sufficient TTL for the termination packet to make it to but above a gap in the received bytestream. Finally, we the receiver), after which we verified we can success- include any additional information using a leading sub- fully access banned content. Moreover, simply sending F script. For example, IP(TTL=
4 Test Evasion Class Description Circumvention Fixing Receiver Opportunities Cost Dependent?
IP1 Ambiguity IP(TTL=
TCP2 Incompleteness IP(ack=
TCP3 Incompleteness IP(chksum=
TCP7 State Management τ(≤ ≈ 10 hr), pi(Bad) =⇒ reset State exhaust. High + TCP8 State Management (pi(Good) ∧ δ(Good) ≤ ≈ 1 GB), pi+1(Bad) =⇒ reset State exhaust. High + TCP9 State Management hole,(pi(Good) ∧ δ(Good) ≥ 1 KB ∧ abovehole(pi)), State exhaust. High pi+1(Bad) =⇒ ¬reset
TCP10 State Management hole, τ(y) ≥ 60 min, (pi(Bad)∧abovehole(pi)) =⇒ ¬reset State exhaust. High HTTP1 Ambiguity GET with > 1 space between method and URI =⇒ ¬ reset Evasion Low HTTP2 Incompleteness GET with keyword at location > 2048 =⇒ ¬ reset Evasion Low HTTP3 Incompleteness GET with keyword in ≥ 2nd of multiple requests in single Evasion Low segment =⇒ ¬ reset HTTP4 Incompleteness GET with URL encoded (except %-encoding) =⇒ ¬ reset Evasion Low
Table 1: Evasion opportunities in GFW’s analysis of network traffic.
Next, we aim to establish how comprehensively GFW will look into an HTTP packet to extract these fields, In the last section we identified a number of evasion which has relevance because HTTP allows multiple out- opportunities to counter GFW censorship. Here we dis- standing requests (“pipelining”), and TCP segmentation cuss the potential level of difficulty that GFW implemen- can cause these to appear in a single packet. Thus, cor- tors likely face to address issues such as these, basing our rect monitor processing requires extracting all requests rationale on our own experiences with implementing net- present in a packet, not just the first. However, we work monitors. find that GFW inspects only the first Request-URI and High Difficulty. We can readily cause GFW to pro- Host: value (HTTP3). But for some Host: values, cess packets that receivers will not by using a low IP TTL GFW detects them even if placed in subsequent pipelined value (IP1). This vulnerability appears hard to fix, as requests, indicating it must contain two separate black- monitor has little ability to validate the IP TTL through lists evaluated by separate code paths (or two separate passive monitoring, given a discrepancy of just one hop devices operate along the same path). One of these ap- suffices for the evasion. Hop counts can vary organically pears to have the form “Host: *.baddomain.com”, for due to routing changes, making an accompanying deci- which it scans the entire bytestream, while the other con- sion process difficult to determine. tains keywords for which it only scans the first instance Removing ambiguities arising from reassembly of of a URI and a Host: header in a packet. partially overlapping fragments (IP2) and TCP streams Finally, we test GFW’s decoding capabilities by en- (TCP5) appears expensive for monitor. It requires either coding sensitive URIs using different encoding tech- in-line normalization [11,19], imposing performance and niques. The tests reveal that GFW only processes robustness concerns, or prior knowledge of end host im- standard URI percent-encoding, but not numerous oth- plementation behavior [17], unscalable for a nation-wide ers [16]. Many of the latter have only partial support censorship system. amongst web servers, but for those that do support them, TCB teardown (TCP6a) marks the point at which a they provide quite convenient evasion. monitor decides to stop maintaining information about 6. The Cost of Fixing Evasion Bugs
5 a connection.2 This is a critical decision because if a We explore this problem space inspired by prior work monitor deletes the TCB of a connection that has not ac- analyzing the vulnerabilities of NIDS to forms of eva- tually terminated, it loses any further monitoring oppor- sion. We consider general classes of evasions to which tunities. In principle, the monitor could kill connections monitors can be vulnerable and develop an extensive set for which it discards state, but doing so would incur large of probe tests for each category, using the tests to illu- collateral damage if either the monitor has state-holding minate the analysis model of China’s GFW. Based on problems, or if routing changes bring new active flows by GFW’s responses (or lack thereof) to our probes, we one of its monitors. A similar problem arises for the state identified a number of facets of how it performs its mon- management issues sketched in TCP7–TCP10, i.e., dis- itoring: tinguishing timed-out connections from those that sim- • ply lie dormant. GFW’s current design choice of keeping GFW operates in a stateful manner, but limits its state for lengthy periods of time (except for connections analysis to one direction only (client-to-server) . with holes) renders it vulnerable to resource-exhaustion • We can manipulate GFW’s connection manage- attacks. However, the alternate option of timing out in- ment state (TCB) both in terms of inducing state active connections risks evasion possibilities. for connections that do not actually exist (creat- One other approach GFW could implement would be ing SYN-flooding and unsynchronized-monitoring to use “cold start” to re-instantiate state for connections vulnerabilities) and triggering tear-down of state that continue to be active after the monitor has either dis- for connections that still exist (spoofed termination carded state for them or observed them to apparently ter- packets, timeouts, accelerated timeouts for connec- minate [11]. This would enable it to recover memory tions with sequence holes). for connections that have genuinely terminated, but still • GFW is prone to state exhaustion attacks, as it monitor those that somehow continue. However, this at maintains state for ≥ 10 hours of inactivity. best provides a partial solution. The cold-start approach • GFW employs specific fragment and TCP segment of [11] relied on the fact that the local side of each con- reassembly policies, enabling evasions by overlap- nection could be deemed trustworthy. In our context, ping fragments or segments for receivers whose this is not the case, and can be leveraged for evasion policies differ. by, for example, splitting a banned keyword across the bytestream as seen prior to a connection’s state apparent • GFW’s HTTP request processing has numerous termination versus after its reappearance. omissions and limitations (syntax tweaks can un- Low Difficulty. A number of the evasions we list dermine blacklist matching; elements of pipelined (TCP1–TCP4, HTTP1–HTTP4) are simple to fix, likely requests go unanalyzed). requiring only modest modifications to the existing code Our preliminary results suggest numerous directions base. For example, the censor can address TCB creation for further exploration: (1) automated model extraction issues (TCP1) by creating a TCB only upon seeing both (turn-key generation of full analysis profiles of moni- a SYN and the corresponding SYN-ACK, since the latter tor); (2) evasion tools (using the output of such extrac- is difficult to spoof. tion to automatically configure tools for permuting a sys- However, some of these will reflect design decisions tem’s traffic to facilitate circumvention); (3) assessment to trade off performance for completeness. Thus, even of analysis incongruity (e.g., tracking how GFW’s anal- fixing these simple problems could represent significant ysis components both differ across various points in the burdens for the implementors. network, and evolve over time); (4) policy discrepancies (e.g., whether a censor employs different policies for dif- 7. Conclusion and Future Directions ferent protocols or web sites). Our work focuses on the observation that monitors that Acknowledgments dynamically inspect and censor network traffic funda- mentally must employ some sort of analysis model to This work was supported by the National Science Foun- determine whether the traffic includes prohibited content. dation under grants 1223717 and 1237265, Any opin- Inference of this model can then enable systematic iden- ions, findings, and conclusions or recommendations ex- tification of evasion opportunities that users can exploit pressed in this material are those of the authors and do to access restricted content by permuting their network not necessarily reflect the views of the sponsors. traffic accordingly. 8. References 2 TCP6b reflects a similar state-holding issue as TCP6a, but one easy to fix as it is based on an incorrect implementation of [1] sniffjoke. http: the TCP specification. //www.delirandom.net/sniffjoke/.
6 [2] HTTP URL/keyword detection in depth. IEEE 30th International Conference on http://gfwrev.blogspot.jp/2010/03/http-url.html, Distributed Computing Systems, ICDCS ’10, pages 2010. 315–326, Washington, DC, USA, 2010. IEEE [3] Scholar Zhang: Intrusion detection evasion and Computer Society. black box mechanism research of the Great [14] J. Postel. RFC 793: Transmission Control Firewall of China. Protocol, Sept. 1981. https://code.google.com/p/scholarzhang/, 2010. [15] T. H. Ptacek and T. N. Newsham. Insertion, [4] west-chamber-season-2. Evasion, and Denial of Service: Eluding Network https://code.google.com/p/west-chamber-season- Intrusion Detection. Technical report, Secure 2/, Networks, Inc., Suite 330, 1201 5th Street S.W, 2010. Calgary, Alberta, Canada, T2R-0Y6, 1998. [5] west-chamber-season-3. [16] D. Roelker. HTTP IDS Evasion Revisited. https://github.com/liruqi/west-chamber-season-3/, Technical report, Aug. 2003. 2011. [17] U. Shankar and V. Paxson. Active Mapping: [6] D. Anderson. Splinternet Behind the Great Resisting NIDS Evasion without Altering Traffic. Firewall of China. Queue, 10(11):40:40–40:49, In Proceedings of the 2003 IEEE Symposium on Nov. 2012. Security and Privacy, SP ’03, pages 44–, [7] P. Biondi. Scapy. http: Washington, DC, USA, 2003. IEEE Computer //www.secdev.org/projects/scapy/. Society. [8] R. Clayton, S. J. Murdoch, and R. N. M. Watson. [18] D. Song. fragroute. http://www.monkey. Ignoring the Great Firewall of China. In org/~dugsong/fragroute/. G. Danezis and P. Golle, editors, Proceedings of [19] M. Vutukuru, H. Balakrishnan, and V. Paxson. the Sixth Workshop on Privacy Enhancing Efficient and Robust TCP Stream Normalization. Technologies (PET 2006), pages 20–35, In Proceedings of the 2008 IEEE Symposium on Cambridge, UK, June 2006. Springer. Security and Privacy, SP ’08, pages 96–110, [9] J. R. Crandall, D. Zinn, M. Byrd, E. Barr, and Washington, DC, USA, 2008. IEEE Computer R. East. Conceptdoppler: a weather tracker for Society. Internet censorship. In Proceedings of the 14th [20] N. Weaver, R. Sommer, and V. Paxson. Detecting ACM conference on Computer and Forged TCP Reset Packets. In NDSS, 2009. communications security, CCS ’07, pages [21] P. Winter. brdgrd. https: 352–365, New York, NY, USA, 2007. ACM. //git.torproject.org/brdgrd.git. [10] R. Fielding, J. Gettys, J. Mogul, H. Frystyk, [22] P. Winter and S. Lindskog. How the Great Firewall L. Masinter, P. Leach, and T. Berners-Lee. RFC of China is blocking Tor. In Proceedings of the 2616: Hypertext Transfer Protocol – HTTP/1.1, USENIX Workshop on Free and Open 1999. Communications on the Internet (FOCI 2012), [11] M. Handley, V. Paxson, and C. Kreibich. Network August 2012. Intrusion Detection: Evasion, Traffic [23] X. Xu, Z. M. Mao, and J. A. Halderman. Internet Normalization, and End-to-end Protocol censorship in China: where does the filtering Semantics. In Proceedings of the 10th conference occur? In Proceedings of the 12th international on USENIX Security Symposium - Volume 10, conference on Passive and active measurement, SSYM’01, pages 9–9, Berkeley, CA, USA, 2001. PAM’11, pages 133–142, Berlin, Heidelberg, USENIX Association. 2011. Springer-Verlag. [12] L. Juan, C. Kreibich, C.-H. Lin, and V. Paxson. A tool for offline and live testing of evasion resilience in network intrusion detection systems. In Proceedings of the 5th international conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA ’08, pages 267–278, Berlin, Heidelberg, 2008. Springer-Verlag. [13] J. C. Park and J. R. Crandall. Empirical Study of a National-Scale Distributed Intrusion Detection System: Backbone-Level Filtering of HTML Responses in China. In Proceedings of the 2010
7