Lesson 13-Intrusion Detection Systems

1. Lesson 13-Intrusion Detection Systems

2. Background • A layered network security approach starts with a well-secured system. • Layers of protection such as antivirus products, firewalls, sniffers, and intrusion detection systems can be added to a well secured system.

3. Background • Network security can be compared to physical security. • The more people wish to protect something and restrict access to it, the more security is required.

4. Background

5. Background • Adding more protective devices adds “layers” of security that an intruder would have to overcome or breach to access whatever is being protected. • Network and data security includes protective layers in the form of passwords, firewalls, access lists, file permissions, and intrusion detection systems. • Most organizations have their own approach to network security, choosing the “layers” that make sense for them after they weigh risks, potential for loss, cost, and manpower requirements.

6. Background • A layered network security approach starts with a well-secured system: • Up-to-date application and operating system patches. • Well-chosen passwords. • The minimum number of services running. • Restricted access to available services.

7. Background • Layers of protective measures, such as antivirus products, firewalls, sniffers, and intrusion detection systems, can be added.

8. Background • One of the more complicated and interesting types of network/data security devices are intrusion detection systems (IDS). • An IDS is to the network as burglar alarms are to the physical world.

9. Background • This presentation examines: • The history of IDS. • The various types of intrusion detection systems. • How they work. • The benefits and weaknesses of specific types. • The future of these systems.

10. Background • The presentation also examines some complementary topics such as: • Honeypots • Incident response

11. Objectives • Upon completion of this lesson, the learner will be able to: • Explain host-based intrusion detection systems. • Explain network-based intrusion detection systems. • Describe honeypots and explain what they are used for. • Describe how to conduct incident response operations.

12. History of IDS • In 1972, James Anderson published a paper outlining the growing number of computer security problems and the immediate need to secure Air Force systems (James P. Anderson, “Computer Security Technology Planning Study Volume 2,” October 1972, http:// seclab.cs.ucdavis.edu/projects/history/papers/ande72.pdf).

13. Continued IDS Research • Anderson continued his research and, in 1980, published a follow-up paper outlining methods to improve security auditing and surveillance methods. • He pioneered the concept of using system audit files to detect unauthorized access and misuse.

14. Denning and Neumann Research • IDS came into existence when Dorothy Denning and Peter Neumann developed the first real-time IDS model, called “The Intrusion Detection Expert System (IDES),” following their research between 1984 and 1986.

15. Denning and Neumann Research • In 1987, Denning published “An Intrusion-Detection Model,” a paper that laid out the model on which most modern intrusion detection systems are based.

16. Government-Funded Research • With a model and its definitions in place, the U.S. government continued to fund research for projects, such as: • Discovery • Haystack • Multics Intrusion Detection and Alerting System (MIDAS) • Network Audit Director and Intrusion Reporter (NADIR)

17. IDS Commercialization • In 1989, Haystack Labs released “Stalker,” the first commercial intrusion detection system. • The host-based system worked by comparing audit data to known patterns of suspicious activity.

18. WheelGroup/NetRanger • In 1995, WheelGroup developed NetRanger, the first commercial network-based intrusion detection product. • It monitored network links and the traffic moving across them to identify misuse as well as suspicious and malicious activity. • Cisco Systems acquired WheelGroup in February 1998 and intrusion detection systems were recognized as a vital part of any network security infrastructure.

19. History In Perspective

20. Purpose of an IDS • The purpose of an intrusion detection system is to: • Identify suspicious or malicious activity. • Note activity that deviates from normal behavior. • Catalog and classify the activity. • Respond to the activity.

21. Two Main Categories • Intrusion detection systems are typically divided into two main categories, depending on how they monitor activity: host-based and network-based.

22. Two Main Categories • Host-Based IDS • A host-based IDS is concerned only with activity on an individual system and usually has no visibility into the activity on the network or systems around it. • Network-Based IDS • A network-based IDS has visibility only into the traffic crossing the network link it is monitoring and typically has no idea of what is happening on individual systems.

23. IDS Components • Traffic collector collects activities/events for the IDS to examine. • On a host-based IDS, this could be log files, audit logs, or traffic coming to or leaving a specific system. • On a network-based IDS, this is typically a mechanism for copying traffic off the network link—basically functioning as a sniffer.

24. IDS Components • Analysis engine:  • Examines the collected network traffic and compares it to known patterns of suspicious or malicious activity stored in the signature database.

25. IDS Components • Signature database:  • Is a collection of patterns and definitions of known suspicious or malicious activity.

26. IDS Components • User interface and reporting:  • Is the component that interfaces with the human element, providing alerts when appropriate and giving the user a means to interact with and operate the IDS.

27. Tuning an IDS • Most IDSs can be “tuned” to fit a particular environment. • Signatures may be turned off – the IDS will not to look for certain types of traffic. • Alarm levels can be adjusted depending upon certain types of traffic. • Some IDS also allow users to “exclude” certain patterns of activity from specific hosts.

28. Host-Based IDS Host-Based IDS • A host-based IDS (HIDS) examines log files, audit trails, and network traffic coming in to or leaving a specific host.

29. Host-Based IDS • A host-based IDS (HIDS) operates in: • Real time, looking for activity as it occurs. • Batch mode, looking for activity on a periodic basis.

30. Host-Based IDS • They may be self-contained, but many of the newer commercial products have been designed to report to and be managed by a central system. • Host-based systems use local system resources to operate.

31. Focus on Log Files • Host-based intrusion detection systems focus on the log files or audit trails from the local operating system. • The IDS looks for hostile actions or misuse activities, such as: • Logins at odd hours • Login authentication failures • Adding new user accounts • Modification or access of critical system files • Modification or removal of binary files (executables) • Starting or stopping processes • Privilege escalation • Using certain programs

32. IDS Logical Layout • Host-based intrusion detection systems operate similarly. • An insight into how host-based intrusion detection systems operate can be obtained by considering the function and activity of each component.

33. IDS Collector • The traffic collector pulls in information for the other components, such as the analysis engine. • It pulls already generated data from the local system – error messages, log files, and system files. • It is responsible for reading files, selecting items of interest, and forwarding them to the analysis engine. • On some host-based systems, it also examines specific attributes of critical files such as file size, date modified, or checksum.

34. IDS Analysis Engine • It is a sophisticated decision and pattern-matching mechanism. • It looks at data given to it by the traffic collector and matches it to known patterns of activity stored in the signature database. • If the activity matches a known pattern, the analysis engine reacts with an alert or alarm.

35. IDS Analysis Engine • An analysis engine is capable of remembering how the current activity compares to historic or future traffic, so that it may match more complicated, multi-step malicious activity patterns. • An analysis engine must also be capable of examining traffic patterns as quickly as possible. • The longer it takes to match a malicious pattern, the less time the IDS or human operator has to react to malicious traffic.

36. IDS Signature Database • The signature database is a collection of predefined activity patterns that have already been identified and categorized as activity patterns typical of suspicious or malicious activity. • When the analysis engine has a traffic pattern to examine, it compares it to the signatures in the database.

37. User Interface • It is the visible component of the IDS—the part that humans interact with. • Independent of the type and complexity, the interface allows users to interact with the system by: • Changing parameters • Receiving alarms • Tuning signatures and response patterns

38. Host-Based Advantages • The advantages of host-based IDSs include: • Operating system-specific. • More detailed signatures. • Reduced false positive rates. • Examination of data after decryption. • Application specific. • Alarm may impact determination of a specific system.

39. Host-Based Disadvantages • Before deployment, weigh the disadvantages of this technology: • An IDS has a process on every system watched.  • An IDS has a high cost of ownership.  • An IDS uses local system resources.  • An IDS has a focused view and cannot relate to activity around it.  • A locally logged IDS may be compromised or disabled.

40. Active vs. Passive IDS • Intrusion detection systems can be distinguished by how they examine the activity around them and whether or not they interact with that activity.

41. Passive Host IDS • A passive system watches the activity, analyzes it, and generates alarms. • It does not interact with the activity itself in any way. • It does not modify the defensive posture of the system to react to the traffic.

42. Active Host IDS • An active IDS contains the same components and capabilities as the passive IDS. • However, the active IDS reacts to the activity it is analyzing.

43. Network-Based IDS • Network-based IDS focuses on network traffic. • Bits and bytes traveling through cables interconnecting the systems. • A network IDS (NIDS) examines network traffic as it passes by. • It must be able to analyze traffic by protocol, type, amount, source, destination, content, and traffic already seen. • The analysis must happen quickly. • The IDS must be able to handle traffic at whatever speed the network operates to be effective.

44. Network-Based IDS • What does it look for? • Like host-based systems, a network-based IDS looks for activities that represent hostile actions or misuse. • Denial-of-Service attacks • Port scans or sweeps • Malicious content in the data payload of a packet or packets • Vulnerability scanning • Trojans, viruses, or worms • Tunneling • Brute-force attacks

45. Network IDS Components • The components of a network-based intrusion detection system are similar to those of a host-based system. • Traffic collector • Analysis engine • Signature database • User interface

46. Network IDS Traffic Collector • The traffic collector in a network-based IDS pulls traffic from the network. • It behaves the same way as a network traffic sniffer. • It pulls every packet from the connected network.

47. Network IDS Traffic Collector • The traffic collector attaches itself logically to a network interface card (NIC) and instructs the NIC to accept every packet it can. • A NIC that accepts and processes every packet regardless of the packet's origin and destination is said to be in “promiscuous” mode.

48. Network IDS Analysis Engine • It has the same function as its host-based counterpart, with substantial differences. • The network analysis engine must be capable of collecting packets and examining them individually. • If necessary, it reassembles them into an entire traffic session.

49. Analysis Engine Pattern Matching • Patterns and signature matching is more complicated than host-based signatures. • The analysis engine must remember what traffic preceded the traffic currently being analyzed to determine whether or not that traffic fits a larger pattern of malicious activity.

50. Analysis Engine Pattern Matching • The network-based analysis engine must be able to keep up with the flow of traffic on the network, rebuilding network sessions and matching patterns in real time.