Asynchronous transfer mode (ATM) intrusion detection

Abstract

ATM networks are the foundation for a number of public and private networks and their correct operation is critical to the availability of higher layer protocols (such as IP) and applications. However, ATM uses a number of protocols for connection establishment and routing and if these protocols are not functioning correctly (e.g., due to misconfiguration, component failure or active attack), denial of service may result. Since ATM protocol irregularities occur below IP, they are not detectable by the IP intrusion detection systems that are prevalent in today's networks. This paper describes an implementation of an intrusion detection system that detects ATM protocol attacks. This system uses a centralized assessment engine to collect network event notifications from a distributed set of sensors. These sensors monitor ATM protocol activity and send the filtered events to the assessment engine. The assessment engine compares the incoming event traffic against a set of attack templates and, if a match is encountered, it (optionally) activates a set of responses. In addition, this paper describes results that have been obtained from the proof-of-concept implementation, along with initial experience with its use in operational networks. Future research directions that address other unique challenges presented by ATM intrusion detection and response are also described.