Attack traffic libraries for testing and teaching intrusion detection systems

Various attack traffic libraries have been available for quite some time. However, a majority of these libraries contain additional miscellaneous or highly unorganized network traffic. Our research aims at creating a framework for building small, clean, reusable, attack specific network captures. These captures can be used for teaching intrusion detection system monitoring, access control list creation, device configuration, and testing. The lack of organized individual attack captures makes finding specific examples of attack traffic difficult. Our work takes the concept of attack traffic libraries and builds on it. The PCAP Attack Library (PAL) that we have created is simple to use and easily expandable. We captured individual examples of attack traffic and classified each attack according to the Common Attack Pattern Enumeration and Classification (CAPEC) library. Each of our cataloged attacks include; a re-playable traffic file, a corresponding CAPEC attack identification number for obtaining further attack details, and a working Snort Intrusion Detection System rule (SIDSr) which can be used to detect the specific attack. A framework for cataloging and extending the PCACP Attack Library is also presented. This work is equally valuable to instructors and professionals responsible for maintaining an intrusion detection system. Educators and professionals now have access to specific replayable attack traffic without needing the original tools or knowledge required to create the attack.