Intrusion Detection Systems Overview IDS Components Events of

Intrusion Detection Systems

Overview • IDS Components • Events of Interest • Limits to observation • Signature vs. Anomaly Based IDS • Rule sets • Network vs. Host Based IDS • Intrusion Prevention Systems • Classification Errors • Base Rate Fallacy 2

Components of IDS • Intrusion Detection Systems (IDS) consists of software and hardware designed to detect malicious activity on the network. • Sensors – generate alerts or other security events • Console – monitor alerts and events, control sensors • Engine – record events logged by the sensors and generate alerts based on a set of rules 3

Events of Interest (EOI) • The purpose of the IDS is to report on Events Of Interest (EOIs) EOIs Collectable Events All data • Not all important events are observable … • … just because it is observable does not mean it is important 4

Limits to observation IDS cannot capture every EOI. These limits to observation arise because: • Events may occur on a different network • The sensor is not working • If we are lucky, we know it is broken • The IDS does not understand the protocol • The IDS has reached its bandwidth limit 5

The Human Element Humans also limit what EOIs can be observed • Human Limits caused by the analyst • Human Limits caused by the CIRT • snort/shadow/(insert your favorite IDS here) is no more an Intrusion Detection System than a wrench is a Car Repair System • The human in the system must decide on the validity and severity of the alert 6

Signature vs. Anomaly Based IDS • A signature based IDS (like snort) examines traffic, looking for known patterns • the packet with a known signature is the EOI • very good at catching what we already know about • An anomaly based IDS looks for unusual activity • uses a set of heuristic (simplifying) rules to determine what is normal behavior • requires that the system be trained to recognize normal behavior • Signature based are much more generally deployed 7

snort rule sets snort is an open source network IDS • It is signature based, and its rules have two parts: • rule header • rule options in parenthesis • Rules can be multi-lined by using '' snort manual Figure 3. 1 http: //www. snort. org/docs/snort_htmanuals/htmanual_283/node 196. html 8

Network IDS • A network IDS (NIDS) such as snort examines packets • It uses those to detect malicious activity • • port scans Do. S, DDo. S Known malware strings (eg. buffer o-flow shell code) Protocol misuse • Unlike traditional firewall deployments, a NIDS also looks for malicious activity leaving the network 9

Zoned Network Dept Network Zoned Architecture Internet Svcs Network Zoned Architecture • The Departmental network delivers Unclassified (including Protected A or Protected B) business applications to public servants. • The primary purpose of the Internet Services network is to provide Unclassified (Protected B and below) business application delivery via the Internet to the public. 10

Enterprise Network Topology NIDS looks for anomalous packets 11

Host-Based IDS • Host-based IDS (HIDS) attempts to detect malicious activity by monitoring system resources • memory • files • processes • Both NIDS and HIDS should be used as defense in depth • Requires fusion of EOIs 12

Integrating IDS DMZ DNS IDS IDS IDS web. IDS mail IDS Security Admin: IDS event fusion 13

Intrusion Prevention Systems • Similar to an IDS, an Intrusion Prevention System (IPS) monitors network or system resources for malicious activity • aka reactive IDS • implementations include • snort also advertises itself as a NIPS • But IPS can react to those malicious events • change the firewall configuration • update routing decisions • quarantine intruders 14

NIPS in-line Because NIPS are typically deployed in-line, they can react in "real time" 15

Classification Errors • There are two kinds of errors No Malicious Activity Present IDS does not raise alarm IDS raises an alarm Valid Negative False Positive Type I Malicious False Negative Valid Positive Activity Present Type II • There is a trade-off between these two kinds of errors • IDS protect against false negative by raising lots of alarms 16

Base Rate Fallacy • Imagine that you have a great IDS, which is 99. 99% effective! • Only 1 of every 10, 000 malicious packets will be missed (False Negative) • Only 1 of every 10, 000 legitimate packets will raise an alarm (False Positive) • One of every 1, 000 packets is malicious • Given an alert, what is the probability that the packet that raised the alert is malicious? 17

Base Rate Fallacy • The probability that a packet will raise an alert is • 0. 0000009999 + 0. 0000999999 = 0. 0001009998 • Given an alert, the probability that it is False is • 0. 000099999 / 0. 0001009998 = 99. 01% • The Base Rate (the rate of malicious to total packets) is so low that we will be chasing false alerts all the time. 18

Data Mining for IDS • Determining the severity of the alert is where the analyst is crucial • There must be a correlation between the alert and the traffic that generated it • Suricata can log part of the packet • tcpdump or other sniffers can capture the packets for analysis. • We will put this in practice in an exercise. 19

Questions?

References 1. Northcutt S. Novak J. , Network Intrusion Detection, 3 rd Ed, New Riders, 2003 2. NIST, Guide to Intrusion Detection and Prevention Systems, Special Publication 800 -94 3. en. wikipedia. org/wiki/Intrusion_detection_system 4. en. wikipedia. org/wiki/Intrusion_prevention_system 21