A Wavelet Approach to Network Intrusion Detection

1. A Wavelet Approach to Network Intrusion Detection W. Oblitey & S. Ezekiel IUP Computer Science Dept. Secure IT - 2005

2. Intrusion Detection: • Provides monitoring of system resources to help detect intrusion and/or identify attacks. • Complimentary to blocking devices. • Insider attacks. • Attacks that use traffic permitted by the firewall. • Can monitor the attack after it crosses through the firewall. • Helps gather useful information for • Detecting attackers, • Identifying attackers, • Reveal new attack strategies. Secure IT - 2005

3. Classification: • Intrusion Detection Systems classified according to how they detect malicious activity: • Signature detection systems • Also called Misuse detection systems • Anomaly detection systems • Also classified as: • Network-based intrusion detection systems • Monitor network traffic • Host-based intrusion detection systems. • Monitor activity on host machines Secure IT - 2005

4. Signature Detection: • Achieved by creating signatures: • Models of attack • Monitored events compared to models to determine qualification as attacks. • Excellent at detecting known attacks. • Requires the signatures to be created and entered into the sensor’s database before operation. • May generate false alarms (False Positives). • Problem: • Needs a large number of signatures for effective detection. • The database can grow very massive. Secure IT - 2005

5. Anomaly Detection: • Creates a model of normal use and looks for activity that does not conform to the model. • Problems with this method: • Difficulty in creating the model of normal activity • If the network already had malicious activity on it, is it ‘normal activity’? • Some patterns classified as anomalies may not be malicious. Secure IT - 2005

6. Network-Based IDS • By far the most commonly employed form of Intrusion Detection Systems. • To many people, “IDS” is synonymous with “NIDS”. • Matured more quickly than the host-based equivalents. • Large number of NIDS products available on the market. Secure IT - 2005

7. Deploying NIDS • Points to consider: • Where do sensors belong in the network? • What is to be protected the most? • Which devices hold critical information assets? • Cost effectiveness; • We cannot deploy sensors on all network segments. • Even not manageable. • We need to carefully consider where sensors are to be deployed. Secure IT - 2005

8. Locations for IDS Sensors • Just inside the firewall. • The firewall is a bottleneck for all traffic. • All inbound/outbound traffic pass here. • The sensor can inspect all incoming and outgoing traffic. • On the DMZ. • The publicly reachable hosts located here are often get attacked. • The DMZ is usually the attacker’s first point of entry into the network. • On the server farm segment. • We can monitor mission-critical application servers. • Example: Financial, Logistical, Human Resources functions. • Also monitors insider attacks. • On the network segments connecting the mainframe or midrange hosts. • Monitor mission-critical devises. Secure IT - 2005

9. The Network Monitoring Problem • Network-based IDS sensors employ sniffing to monitor the network traffic. • Networks using hubs: • Can monitor all packets. • Hubs transmit every packet out of every connected interface. • Switched networks: • The sensor must be able to sniff the passing traffic. • Switches forward packets only to ports connected to destination hosts. Secure IT - 2005

10. Monitoring Switched Networks • Use of Switch Port Analyzer (SPAN) configurations. • Causes switch to copy all packets destined to a given interface. • Transmits packets to the modified port. • Use of hubs in conjunction with the switches. • The hub must be a fault-tolerant one. • Use of taps in conjunction with the switches. • Fault-tolerant hub-like devices. • Permit only one-way transmission of data out of the monitoring port. Secure IT - 2005

11. NIDS Signature Types • These look for patterns in packet payloads that indicate possible attacks. • Port signatures • Watch for connection attempts to a known or frequently attacked ports. • Header signatures • These watch for dangerous or illogical combinations in packet headers. Secure IT - 2005

12. Network IDS Reactions Types • Typical reactions of network-based IDS with active monitoring upon detection of attack in progress: • TCP resets • IP session logging • Shunning or blocking • Capabilities are configurable on per-signature basis: • Sensor responds based on configuration. Secure IT - 2005

13. TCP Reset Reaction • Operates by sending a TCP reset packet to the victim host. • This terminates the TCP session. • Spoofs the IP address of the attacker. • Resets are sent from the sensor’s monitoring/sniffing interface. • It can terminate an attack in progress but cannot stop the initial attack packet from reaching the victim. Secure IT - 2005

14. IP Session Logging • The sensor records traffic passing between the attacker and the victim. • Can be very useful in analyzing the attack. • Can be used to prevent future attacks. • Limitation: • Only the trigger and the subsequent packets are logged. • Preceding packets are lost. • Can impact sensor performance. • Quickly consumes large amounts of disk space. Secure IT - 2005

15. Shunning/Blocking • Sensor connects to the firewall or a packet-filtering router. • Configures filtering rules • Blocks packets from the attacker • Needs arrangement of proper authentication: • Ensures that the sensor can securely log into the firewall or router. • A temporary measure that buy time for the administrator. • The problem with spoofed source addresses. Secure IT - 2005

16. Host-based IDS • Started in the early 1980s when networks were not do prevalent. • Primarily used to protect only critical servers • Software agent resides on the protected system • Signature based: • Detects intrusions by analyzing logs of operating systems and applications, resource utilization, and other system activity • Use of resources can have impact on system performance Secure IT - 2005

17. HIDS Methods of Operation • Auditing logs: • system logs, event logs, security logs, syslog • Monitoring file checksums to identify changes • Elementary network-based signature techniques including port activity • Intercepting and evaluating requests by applications for system resources before they are processed • Monitoring of system processes for suspicious activity Secure IT - 2005

18. Log File Auditing • Detects past activity • Cannot stop the action that set off the alarm from taking place. • Log Files: • Monitor changes in the log files. • New entries for changes logs are compared with HIDS attack signature patterns for match • If match is detected, administrator is alerted Secure IT - 2005

19. File Checksum Examination • Detects past activity: • Cannot stop the action that set off the alarm from taking place. • Hashes created only for system files that should not change or change infrequently. • Inclusion of frequently changing files is a huge disturbance. • File checksum systems, like Tripwire, may also be employed. Secure IT - 2005

20. Network-Based Techniques • The IDS product monitors packets entering and leaving the host’s NIC for signs of malicious activity. • Designed to protect only the host in question. • The attack signatures used are not as sophisticated as those used in NIDs. • Provides rudimentary network-based protections. Secure IT - 2005

21. Intercepting Requests • Intercepts calls to the operating system before they are processed. • Is able to validate software calls made to the operating system and kernel. • Validation is accomplished by: • Generic rules about what processes may have access to resources. • Matching calls to system resources with predefined models which identify malicious activity. Secure IT - 2005

22. System Monitoring • Can preempt attacks before they are executed. • This type of monitoring can: • Prevent files from being modified. • Allow access to data files only to a predefined set of processes. • Protect system registry settings from modification. • Prevent critical system services from being stopped. • Protect settings for users from being modified. • Stop exploitation of application vulnerabilities. Secure IT - 2005

23. HIDS Software • Deployed by installing agent software on the system. • Effective for detecting insider-attacks. • Host wrappers: • Inexpensive and deployable on all machines • Do not provide in-depth, active monitoring measures of agent-based HIDS products • Sometimes referred to as personal firewalls • Agent-based software: • More suited for single purpose servers Secure IT - 2005

24. HIDS Active Monitoring Capabilities • Options commonly used: • Log the event • Very good for post mortem analysis • Alert the administrator • Through email or SNMP traps • Terminate the user login • Perhaps with a warning message • Disable the user account • Preventing access to memory, processor time, or disk space. Secure IT - 2005

25. Advantages of Host-based IDS • Can verify success or failure of attack • By reviewing log entries • Monitors user and system activities • Useful in forensic analysis of the attack • Can protect against non-network-based attacks • Reacts very quickly to intrusions • By preventing access to system resources • By immediately identifying a breach when it occurs • Does not rely on particular network infrastructure • Not limited by switched infrastructures • Installed on the protected server itself • Does not require additional hardware to deploy • Needs no changes to the network infrastructure Secure IT - 2005

26. Active/Passive Detection • The ability of an IDS to take action when they detect suspicious activity. • Passive Systems: • Take no action to stop or prevent the activity. • They log events. • They alert administrators. • They record the traffic for analysis. • Active Systems: • They do all the recordings that passive systems do, • They interoperate with firewalls and routers • Can cause blocking or shunning • They can send TCP resets. Secure IT - 2005

27. Our Approach • We present a variant but novel approach of the anomaly detection scheme. • We show how to detect attacks without the use of data banks. • We show how to correlate multiple inputs to define the basis of a new generation analysis engine. Secure IT - 2005

28. Signals and signal Processing: • Signal definition: • A function of independent variables like time, distance, position, temperature, and pressure. • Signals play important part in our daily lives • Examples: speech, music, picture, and video. • Signal Classification: • Analog – the independent variable on which the signal depends is continuous. • Digital – the independent variable is discrete. • Digital signals are presented a a sequence of numbers (samples). • Signals carry information • The objective of signal processing is to extract this useful information. Secure IT - 2005

29. Energy of a Signal: • We can also define a signal as a function of varying amplitude through time. • The measure of a signal’s strength is the area under the absolute value of the curve. • This measure is referred to as the energy of the signal and is defined as: • Energy of continuous signal • Energy of discrete signal Secure IT - 2005

30. What is Wavelet? ( Wavelet Analysis) • Wavelets are functions that satisfy certain mathematical requirements and are used to represent data or other functions • Idea is not new--- Joseph Fourier--- 1800's • Wavelet-- the scale we use to see data plays an important role • FT non local -- very poor job on sharp spikes Waveletdb10 Sine wave Secure IT - 2005

31. History of wavelets • 1807 Joseph Fourier- theory of frequency analysis-- any 2pi functions f(x) is the sum of its Fourier Series • 1909 Alfred Haar-- PhD thesis-- defined Haar basis function---- it is compact support( vanish outside finite interval) • 1930 Paul Levy-Physicist investigated Brownian motion ( random signal) and concluded Haar basis is better than FT • 1930's Littlewood Paley, Stein ==> calculated the energy of the function 1960 Guido Weiss, Ronald Coifman-- studied simplest element of functions space called atom • 1980 Grossman (physicist) Morlet( Engineer)-- broadly defined wavelet in terms of quantum mechanics • 1985 Stephen Mallat--defined wavelet for his Digital Signal Processing work for his Ph.D. • Y Meyer constructed first non trivial wavelet • 1988 Ingrid Daubechies-- used Mallat work constructed set of wavelets • The name emerged from the literature of geophysics, by a route through France. The word onde led to ondelette. Translation wave led to wavelet Secure IT - 2005

32. Fourier Series and Energy Secure IT - 2005

33. Functions • Functions (Science and Engg) often use time as their parameter • g(t)-> represent time domain • since typical function oscillate – think it as wave– so G(f) where f= frequency of the wave, the function represented in the frequency domain • A function g(t) is periodic, there exits a nonzero constant P s.t. g(t+P)=g(t) for all t, where P is called period • periodic function has 4 important attributes • Amplitude– max value it has in any period • Period---2P • Frequency f=1/P(inverse)– cycles per second, Hz • Phase—Cos is a Sin function with a phase Secure IT - 2005

34. Fourier, Haar • Amplitude, time  amplitude , frequency • 1965 Cooley and Tukey – Fast Fourier Transform • Haar Secure IT - 2005

35. CWT • continuous wavelet transform (CWT) of a function f(t) a mother wavelet • mother wavelet may be real or complex with the following properties • 1.the total area under the curve=0, • 2. the total area of is finite • 3. Admissible condition • oscillate above and below the t-axis • energy of the function is finite function is localize • Infinite number of functions satisfies above conditions– some of them used for wavelet transform • example • Morlet wavelet • Mexican hat wavelet Secure IT - 2005

36. once a wavelet has been chosen , the CWT of a square integrable function f(t) is defined as * denotes complex conjugate For any a, Thus b is a translation parameter Setting b=0, Here a is a scaling parameter a>1 stretch the wavelet and 0<a<1 shrink it Secure IT - 2005

37. Wavelets Fourier Transform CWT = C( scale, position)= Scaling wave means simply Stretching (or Shrinking) it Shifting f (t) f(t-k) Secure IT - 2005

38. Wavelets Continue • Wavelets are basis functions in continuous time • A basis is a set of linearly independent function that can be used to produce a function f(t) • f(t) = combination of basis function = • is constructed from a single mother wave w(t) -- normally it is a small wave-- it start at 0 and ends at t=N • Shrunken ( scaled) • shifted • A typical wavelet compressed j times and shifted k times is • Property:- Remarkable property is orthogonality i.e. their inner-products are zero • This leads to a simple formula for bjk Secure IT - 2005

39. Haar Transform • Digitized sound, image are discrete.  we need discrete wavelet • where ck and dj,k are coefficients to be calculated • example:- consider the array of 8 values (1,2,3,4,5,6,7,8) • 4 average values 4 difference ( detail coefficients) • calculate average, and difference for 4 averages • continue this way • Method is called PYRAMID DECOMPOSITION • Haar transform depends on coeff ½, ½ and ½, - ½ • if we replace 2 by √2 then it is called coarse detail and fine detail Secure IT - 2005

40. Transforms • Transform of a signal is a new representation of that signal • Example:- signal x0,x1,x2,x3 define y0,y1,y2,y3 • Questions • 1. What is the purpose of y's • 2. Can we get back x's • Answer for 2: The Transform is invertible-- perfect reconstruction • Divide Transform in to 3 groups • 1. Lossless( Orthogonal)-- Transformed Signal has the same length • 2. Invertible (bi-orthogonal)-- length and angle may change-- no information lost • 3. Lossy ( Not invertible)-- Secure IT - 2005

41. Answer to Q1: Purpose • IT SEES LARGE vs SMALL • X0=1.2, X1= 1.0, x2=-1.0, x3=-1.2 • Y=[2.2 0 -2.2 0] • Key idea for wavelets is the concept of " SCALE" • We can take sum and difference again==> recursion => Multiresolution • Main idea of Wavelet analysis– analyze a function at different scales– mother wavelet use to construct wavelet in different scale and translate each relative to the function being analyzed • Z=[ 0 0 4.4 0 ] • Reconstruct =====>compression 4:1 Secure IT - 2005

42. Secure IT - 2005

43. Secure IT - 2005

44. Secure IT - 2005

45. Secure IT - 2005

46. Secure IT - 2005

47. Secure IT - 2005

48. Secure IT - 2005

49. Real electricity consumption • peak in the center, followed by two drops, shallow drop, and then a considerably weaker peak • d1 d2 shows the noise • d3– presents high value in the beginning and at the end of the main peak, thus allowing us to locate the corresponding peak • d4 shows 3 successive peak– this fits the shape of the curve remarkably • a1,a2 strong resemblance • a3 reasonable---- a4 lost lots of information Secure IT - 2005

50. Secure IT - 2005