Defending networks against today's attackers is especially challenging for modern intrusion detection/prevention systems for two reasons: the sheer amount of state they must maintain, and the possibility of resource exhaustion attacks on the defense system itself. Our work shows how to cope with these challenges in the context of a TCP stream normalizer whose job is to detect all instances of inconsistent TCP retransmissions.

1. M. Handley,V. Paxson, and C. Kreibich, "Network Intrusion Detection: Evasion, Traffic Normalization, and End-to-End Protocol Semantics," in Proc. USENIX Security Symposium, Aug. 2001.
2. G. Varghese, J. A. Fingerhut, and F. Bonomi, "Detecting Evasion Attacks at High Speeds without Reassembly," in Proc. ACM SIGCOMM, Sept. 2006.
3. "Configuring TCP Normalization," 2006, http://www. cisco. com/en/US/products/ps6120/products configuration guide chapter09186a008054ecb8. html#wp1051891.
4. Mythili Vutukuru, H. Balakrishnan, "Efficient and Robust TCP Stream Normalization", IEEE Symposium on Security and Privacy, May 2008.
5. Anderson, Ross (2008). "Security Engineering – A Guide to Building Dependable Distributed Systems – 2nd edition. John Wiley & Sons.
6. Burns, David (2011). "CCNP Security IPS 642-627 Official Cert Guide". Cisco Press.
7. Thomas H. Ptacek, Timothy N. Newsham, "Insertion, Evasion and denial of service: Eluding Network Intrusion Detection". Jan 1998.
8. Tanenbaum, Andrew S. , "Computer Networks" 4th edition. Pearson Education. "Secure Hash Standard", FIPS – 180, National Institute of Standards and Technology.

Tcp Ip Data Normalization