What is session splicing in the context of IDS evasion techniques?

What is session splicing in the context of IDS evasion techniques?

• A. An IDS evasion technique where data is delivered in large packets.
• B. A technique for evading DNS logging.
• C. An IDS evasion technique where an attacker delivers data in multiple small packets, making it difficult for the IDS to detect attack signatures.
• D. A method of session hijacking.

Answer: (C)

Session splicing is an IDS evasion technique that splits the content of a single session into many small packets. By delivering data in tiny, staggered pieces, the attacker prevents the intrusion detection system from reassembling a complete payload within its inspection window, making it harder for signatures to be matched. IDS often rely on reassembled streams to detect malicious patterns; when data arrives in small fragments or is interleaved with legitimate traffic, the detector may miss the attack. This approach is not about using large packets, evading DNS logging, or hijacking a session. It directly targets the way many IDS perform payload analysis by exploiting their stream reassembly limits.

Session splicing is an IDS evasion technique that splits the content of a single session into many small packets. By delivering data in tiny, staggered pieces, the attacker prevents the intrusion detection system from reassembling a complete payload within its inspection window, making it harder for signatures to be matched. IDS often rely on reassembled streams to detect malicious patterns; when data arrives in small fragments or is interleaved with legitimate traffic, the detector may miss the attack.

This approach is not about using large packets, evading DNS logging, or hijacking a session. It directly targets the way many IDS perform payload analysis by exploiting their stream reassembly limits.