Controlling intrusion detection systems by generating false positives: squealing proof-of-concept

We introduce a new class of attack against a network signature-based intrusion detection system (IDS) which we have tested using SNORT and we call "squealing". This vulnerability has significant implications since it can be generalized to any IDS. While signature-based IDSs have implementation problems with high false positive rates that require tuning, we show a more serious general vulnerability in that packets can be crafted to match attack signatures such that alarms can be selectively triggered allowing a target IDS to be externally controlled by a malicious attacker.