Download - Intrusion Detection Methods
1
Intrusion Detection Methods
“Intrusion detection is the process of identifying and responding to malicious activity targeted at computing and networking resources.”
2
The Seven Fundamentals
1. What are the methods used
2. How are IDS Organized3. What is an intrusion4. How do we trace and how do they hide5. How do we correlate information6. How can we trap intruders7. Incident response
3
The Major components of IDS
• Target System• Feed• Processing• Knowledge base• Storage• Alarms• Operator interface• Communications infrastructure• Multiple IDS• Network management
4
TargetSystem
Feed Processing
SystemManagement
KBStorage
Alarms/Directives
GUI
Communcations Infrastucture
TargetSystem
TargetSystem
NetworkManagment
IDS IDS
Text book: figure 3-1
5
Major components of IDS (cont.)
• Target System– Important networks and systems!
• Feed– Information collected from the target systems
and sent back for processing– Q: should feeds carry raw traffic back to the
processing system? Should they carry alarms? What are the considerations?
6
Major components of IDS (cont.)
• Processing– The execution of the detection algorithms
• Knowledge Base– Used to store information about attacks, user
profiles, ..etc.– Ability to update is an important issue
• Storage– Short term vs. long term storage– Performance and capacity issues
7
Major components of IDS (cont.)
• Alarms and Directives– Various types of configurable alarms and notification
methods are typically supported
– Increasing trend towards using them for automatic reconfiguration of other network components (See CIDF for messaging model)
• Communications infrastructure– Used for communications between IDS components
– Security needs?
8
Major components of IDS (cont.)
• Multiple IDS– Common in many environments– The need for secure integration
• Network management– Integration and interaction issues
9
IDS processing
• Processing components in IDS include:– Engines
• Filters• Set of autonomous agents each performing a
specified task
– Management– Correlation
• Combine results!• Interface with other components
10
IDS algorithms
• Baseline processing
while (true) {
target_system_feed(info);
intrusion_processing(info, results);
If (result == intrusion)
initiate_response(result);
}
11
IDS algorithms (cont.)
• Dynamic association
while (true){
target_system_feed(info);
if (suspicious(info) && new(info))
create new association
if(suspicious(info)&& not new(info))
add to existing association
}
12
IDS algorithms (cont.)
• Audit trail data reduction– Loop over log records
• Consider combinations of records• Check if they are relevant to current incident
– Append to report
• Other types of data reduction?
13
IDS algorithms (cont.)
• Out-of-band correlation processing
while (true){
target_system_feed(info);
if (OOB_data)
get_OOB(operator_input);
if(relevant(info, operator_input)
combine(info, operator_input);
}
14
IDS algorithms (cont.)
• Attack filter pattern matching
while (true){ target_system_feed(info);
For (i=0; i< NumFilters; i++)if (match(filter[i],
info))AttackFound(i)
}
15
IDS Knowledge Base
• Profiles of normal and abnormal behavior
• Attack signatures
• Suspicious traffic patterns / strings
• Information used to initiate responses and actions
16
IDS
Feed
Processing
SystemManagement
StorageAlarms/
Directives
GUI/OperatorInterface
TargetSystem
Knowledge Bases
attacksignatures
otherstatic info
responseactions
userprofiles
systemprofiles
17
IDS Storage
• Archives
• IDS logs
• Dynamic buffer
• The case of Oklahoma bank Camera
• The case of the Cuckoo's Egg
18
IDS
Feed
Processing
SystemManagement
KnowledgeBase
Alams/Directives
GUI/OperatorInterface
TargetSystem
Intrusion Detection Storage
auditlog
bufferarchive
19
CIDF
• Architectural conventions• Message specifications (GIDO: generalized
ID objects)• Transmission standards for sending GIDOs
between components• Communications protocol for CIDF
components• API for CIDF
20
CIDF
• Event generator (E-Box)
• Analysis Engine (A-box)
• Storage (D-Box)
• Response component (R-Box)
http://www.isi.edu/~brian/cidf/
http://www.isi.edu/~brian/cidf/drafts/architecture.txt