Intrusion Detection Methods

1. Intrusion Detection Methods “Intrusion detection is the process of identifying and responding to malicious activity targeted at computing and networking resources.”

2. The Seven Fundamentals • What are the methods used • How are IDS Organized • What is an intrusion • How do we trace and how do they hide • How do we correlate information • How can we trap intruders • Incident response

3. The Major components of IDS • Target System • Feed • Processing • Knowledge base • Storage • Alarms • Operator interface • Communications infrastructure • Multiple IDS • Network management

4. Text book: figure 3-1

5. Major components of IDS (cont.) • Target System • Important networks and systems! • Feed • Information collected from the target systems and sent back for processing • Q: should feeds carry raw traffic back to the processing system? Should they carry alarms? What are the considerations?

6. Major components of IDS (cont.) • Processing • The execution of the detection algorithms • Knowledge Base • Used to store information about attacks, user profiles, ..etc. • Ability to update is an important issue • Storage • Short term vs. long term storage • Performance and capacity issues

7. Major components of IDS (cont.) • Alarms and Directives • Various types of configurable alarms and notification methods are typically supported • Increasing trend towards using them for automatic reconfiguration of other network components (See CIDF for messaging model) • Communications infrastructure • Used for communications between IDS components • Security needs?

8. Major components of IDS (cont.) • Multiple IDS • Common in many environments • The need for secure integration • Network management • Integration and interaction issues

9. IDS processing • Processing components in IDS include: • Engines • Filters • Set of autonomous agents each performing a specified task • Management • Correlation • Combine results! • Interface with other components

10. IDS algorithms • Baseline processing while (true) { target_system_feed(info); intrusion_processing(info, results); If (result == intrusion) initiate_response(result); }

11. IDS algorithms (cont.) • Dynamic association while (true){ target_system_feed(info); if (suspicious(info) && new(info)) create new association if(suspicious(info)&& not new(info)) add to existing association }

12. IDS algorithms (cont.) • Audit trail data reduction • Loop over log records • Consider combinations of records • Check if they are relevant to current incident • Append to report • Other types of data reduction?

13. IDS algorithms (cont.) • Out-of-band correlation processing while (true){ target_system_feed(info); if (OOB_data) get_OOB(operator_input); if(relevant(info, operator_input) combine(info, operator_input); }

14. IDS algorithms (cont.) • Attack filter pattern matching while (true){ target_system_feed(info); For (i=0; i< NumFilters; i++) if (match(filter[i], info)) AttackFound(i) }

15. IDS Knowledge Base • Profiles of normal and abnormal behavior • Attack signatures • Suspicious traffic patterns / strings • Information used to initiate responses and actions

16. Target System IDS Processing GUI/ Operator Interface Alarms/ Directives Storage Feed System Management Knowledge Bases user profiles system profiles attack signatures response actions other static info

17. IDS Storage • Archives • IDS logs • Dynamic buffer • The case of Oklahoma bank Camera • The case of the Cuckoo's Egg

18. Target System IDS Processing GUI/ Operator Interface Alams/ Directives Feed Knowledge Base System Management Intrusion Detection Storage audit log archive buffer

19. CIDF • Architectural conventions • Message specifications (GIDO: generalized ID objects) • Transmission standards for sending GIDOs between components • Communications protocol for CIDF components • API for CIDF

20. CIDF • Event generator (E-Box) • Analysis Engine (A-box) • Storage (D-Box) • Response component (R-Box) http://www.isi.edu/~brian/cidf/ http://www.isi.edu/~brian/cidf/drafts/architecture.txt