Low-Level Network Attack Recognition : A Signature-Based Approach ∗

This research presents a new method for detecting network attacks based on network traffic signatures. It is part of a survivability architecture, which focuses on attack recognition, fault-tolerance and recovery after malicious acts. The attack recognition portion emphasizes low-level analysis of network traffic, high efficiency, real-time operation, and accurate identification of attacks. Attack recognition is based on the analysis of TCP protocol flags with respect to specific attacks and is characterized by its simplicity.