Intrusion Detection Systems Casey Wilson

Outline Start reserving your topology Learning goals Background Variations

Reserve topology Go to: https://goo.gl/zZF5j7 Use RSPEC http://mountrouidoux.people.cofc.edu/ CyberPaths/files/IDSLabEasyRSpec.txt

Learning Goals Setup an IDS and verify that it functions properly Study and understand IDS logs Apply concepts of intrusion detection in a real scenario Create a custom Intrusion Detection System (IDS) rule

Intrusion Detection Systems and Mitigation Goals: Install Snort IDS on monitor machine Duplicate all traffic to monitor Create a custom alert for Snort IDS Use mitigation script Drop malicious traffic Send Spoofed SYN Send SYN-ACK Resend SYN-ACK Attacker Server Spoofed Client

Background Intrusion Detection and Prevention Systems Computer Networks Software Defined Networks Command Line GENI DoS

Detection via Signatures Signature checking: does packet match some signature? Payload, e.g., shellcode Header, e.g., SYN Problem: not so great for zero-day attacks -- Q: WHY?

DDoS TCP SYN Flood Insights: Traffic pattern Spoofed IPs Send Spoofed SYN Send SYN-ACK Resend SYN-ACK Attacker Server Spoofed Client Insights: Traffic pattern Spoofed IPs

Snort Open source IDS Signature detection Lots of available rulesets alert tcp $EXTERNAL_NET any -> $SQL_SERVERS 3306 (msg:"MYSQL root login attempt"; flow:to_server,established; content:"|0A 00 00 01 85 04 00 00 80|root|00|"; classtype:protocol-command-decode; sid:1775; rev:2;)

Variations Two levels: one uses OpenFlow and one is not Different attacks: Slowloris Privilege escalation Advanced level: use the power of SDN to detect and mitigate the port(s) from which DoS is coming

Questions? And one last thing… go to nxt slide Let’s experiment!

Correlation and Mitigation Use monitor to alert correlator Correlator is logic that communicates with controller, gathers info about attack Correlator decides based on controller info if there is an attack Correlator logic is implemented in Python

Monitor Listen for IDS alerts Alert threshold = # SYN packets / sec Send alert flag to correlator Send IPs of selected SYN packets to correlator Flag can be attack type

Monitor – real time snort alert monitoring

Monitor – send alert to correlator

Correlator Original Flow Table Flow Table Snapshot1 Key Value port1 IP1 port2 IP2 port3 IP3 … portn IPn Key Value port1 IP1 port2 IP12345 port3 IP3 portn IPn Key Value port1 IP1 port2 IP6789 port3 IP3 portn IPn Hash table based on the original flow table of OVS switch Query this table using the IP addresses from the monitor to look for any unknown IPs Additional queries to a second hash table created based on the current flow table Original Flow Table Flow Table Snapshot1 Flow Table Snapshot2

Correlator – parse and process flowdump

Correlator – block the port of attack

Role of SDN in Implementation Duplicate flows Flow table information detects attacker Drop flows to mitigate Duplication is implemented with Mirroring We may mitigate real traffic – flash crowd Deep packet inspection Second chance

Questions? Let’s experiment!