1

Intrusion Detection Methods

“Intrusion detection is the process of identifying and responding to malicious activity targeted at computing and networking resources.”

2

The Seven Fundamentals

1. What are the methods used

2. How are IDS Organized3. What is an intrusion4. How do we trace and how do they hide5. How do we correlate information6. How can we trap intruders7. Incident response

3

The Major components of IDS

• Target System• Feed• Processing• Knowledge base• Storage• Alarms• Operator interface• Communications infrastructure• Multiple IDS• Network management

4

TargetSystem

Feed Processing

SystemManagement

KBStorage

Alarms/Directives

GUI

Communcations Infrastucture

TargetSystem

TargetSystem

NetworkManagment

IDS IDS

Text book: figure 3-1

5

Major components of IDS (cont.)

• Target System– Important networks and systems!

• Feed– Information collected from the target systems

and sent back for processing– Q: should feeds carry raw traffic back to the

processing system? Should they carry alarms? What are the considerations?

6

Major components of IDS (cont.)

• Processing– The execution of the detection algorithms

• Knowledge Base– Used to store information about attacks, user

profiles, ..etc.– Ability to update is an important issue

• Storage– Short term vs. long term storage– Performance and capacity issues

7

Major components of IDS (cont.)

• Alarms and Directives– Various types of configurable alarms and notification

methods are typically supported

– Increasing trend towards using them for automatic reconfiguration of other network components (See CIDF for messaging model)

• Communications infrastructure– Used for communications between IDS components

– Security needs?

8

Major components of IDS (cont.)

• Multiple IDS– Common in many environments– The need for secure integration

• Network management– Integration and interaction issues

9

IDS processing

• Processing components in IDS include:– Engines

• Filters• Set of autonomous agents each performing a

specified task

– Management– Correlation

• Combine results!• Interface with other components

10

IDS algorithms

• Baseline processing

while (true) {

target_system_feed(info);

intrusion_processing(info, results);

If (result == intrusion)

initiate_response(result);

}

11

IDS algorithms (cont.)

• Dynamic association

while (true){

target_system_feed(info);

if (suspicious(info) && new(info))

create new association

if(suspicious(info)&& not new(info))

add to existing association

}

12

IDS algorithms (cont.)

• Audit trail data reduction– Loop over log records

• Consider combinations of records• Check if they are relevant to current incident

– Append to report

• Other types of data reduction?

13

IDS algorithms (cont.)

• Out-of-band correlation processing

while (true){

target_system_feed(info);

if (OOB_data)

get_OOB(operator_input);

if(relevant(info, operator_input)

combine(info, operator_input);

}

14

IDS algorithms (cont.)

• Attack filter pattern matching

while (true){ target_system_feed(info);

For (i=0; i< NumFilters; i++)if (match(filter[i],

info))AttackFound(i)

}

15

IDS Knowledge Base

• Profiles of normal and abnormal behavior

• Attack signatures

• Suspicious traffic patterns / strings

• Information used to initiate responses and actions

16

IDS

Feed

Processing

SystemManagement

StorageAlarms/

Directives

GUI/OperatorInterface

TargetSystem

Knowledge Bases

attacksignatures

otherstatic info

responseactions

userprofiles

systemprofiles

17

IDS Storage

• Archives

• IDS logs

• Dynamic buffer

• The case of Oklahoma bank Camera

• The case of the Cuckoo's Egg

18

IDS

Feed

Processing

SystemManagement

KnowledgeBase

Alams/Directives

GUI/OperatorInterface

TargetSystem

Intrusion Detection Storage

auditlog

bufferarchive

19

CIDF

• Architectural conventions• Message specifications (GIDO: generalized

ID objects)• Transmission standards for sending GIDOs

between components• Communications protocol for CIDF

components• API for CIDF

20

CIDF

• Event generator (E-Box)

• Analysis Engine (A-box)

• Storage (D-Box)

• Response component (R-Box)

http://www.isi.edu/~brian/cidf/

http://www.isi.edu/~brian/cidf/drafts/architecture.txt