Is a Network Intrusion Detection System (NIDS) (pattern matching, protocol analysis or behavior analysis) able to detect buffer overflow in the network traffic?

closed as too broad by M'vy, Jens Erat, Xander, Abe Miessler, schroeder Feb 6 '15 at 18:02

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


An NIDS would not be able to detect a buffer overflow for a couple of reasons.

  1. It's impossible to know what the target platform for the payload is; strictly based off of network traffic.
  2. Exploits at the network level most likely target some application or daemon on the other side. The buffer overflow is likely targeting a specific vulnerability, and this is also not possible to know by strictly looking at network traffic.

Lets assume that you're only looking for x86 targeted applications. The IDS would need to disassemble the bytes (assumed to be an x86 payload), and automatically look for buffer overflow looking behavior. This is assuming that the payload is not encrypted or compressed. In which case this process is all for nothing.

Even with those assumptions the amount of time to perform them that type of analysis on every packet entering a system would grind the system to a halt. It's just not a feasible task to detect specific attacks that a malicious payload might perform. Flagging malicious packets and logging those packets is the best it can do. And later analysis can be performed either by hand, or by other tools.

Not the answer you're looking for? Browse other questions tagged or ask your own question.