Which term describes deliberately inserting invalid packets to confuse an IDS?

Which term describes deliberately inserting invalid packets to confuse an IDS?

• A. Evasion
• B. Obfuscating
• C. Insertion Attack
• D. Mirai Botnet Attack

Answer: (C)

Deliberately injecting invalid or malformed packets into a data stream is a tactic used to disrupt how an IDS analyzes traffic. By inserting abnormal packets, the attacker can cause desynchronization or misinterpretation of the TCP stream, making it harder for the IDS to correctly reassemble, classify, or alert on the actual malicious activity. This specific idea is captured by the term insertion attack, which names the act of putting illegitimate packets into the flow to confuse the IDS. Evasion is a broader concept of bypassing detection and doesn’t pinpoint the exact method of inserting invalid packets. Obfuscating focuses on concealing the payload rather than introducing invalid packets, and Mirai Botnet Attack refers to a particular malware campaign rather than a general technique.

Deliberately injecting invalid or malformed packets into a data stream is a tactic used to disrupt how an IDS analyzes traffic. By inserting abnormal packets, the attacker can cause desynchronization or misinterpretation of the TCP stream, making it harder for the IDS to correctly reassemble, classify, or alert on the actual malicious activity. This specific idea is captured by the term insertion attack, which names the act of putting illegitimate packets into the flow to confuse the IDS. Evasion is a broader concept of bypassing detection and doesn’t pinpoint the exact method of inserting invalid packets. Obfuscating focuses on concealing the payload rather than introducing invalid packets, and Mirai Botnet Attack refers to a particular malware campaign rather than a general technique.