Methods and systems to detect an evasion attack

Abstract

A method and system to detect an evasion attack are provided. The system may include a repository to store signature fragments that together constitute an attack signature, an interceptor to intercept a data packet associated with a network connection, a string-matching module to determine whether the payload of the data packet includes any of the stored signature fragments thereby identifying a match, a responder to perform a prevention action in response to the match, and a detector to detect that a size of the data packet is less than a size threshold. The system may further include a state machine to commence maintaining a state for the network connection in response to the detector determining that the size of the data packet is less than the size threshold.

1 . An intrusion detection system, the system comprising:
 a slow path to reassemble data packets associated with a network connection; and   a fast path to:
 intercept a data packet associated with the network connection, 
 forward the data packet to its destination if the data packet is not indicative of the attack, and 
 divert the data packet to the slow path if the data packet is indicative of the attack.