Host Intrusion Prevention Systems & Beyond By Dilsad Sera SAHINTEPE

Outline What is Intrusion Detection? Host Based & Network Based What does IDS Detect? IDS types Importance of HIPS IDS Implementation HIDS Difference btw IDS & Firewall Passive/Reactive System Prevention System What is HIPS? IDS differ from HIPS

What is Intrusion Detection ? It is a device or software application that monitors network or system activities for malicious activities or policy violation and produces reports to a management station.

What does IDS Detect? It is a system used to detect unauthorized intrusions into computer systems and network. Example: It detects attacks to FTP, Data driven attacks at the application layer such as SQL injection error could be used to crash an application. IDS Components Sensors – Generate security events such as log files Console – Monitors events, alerts and controls sensors Engine – Analyzes the data using artificial intelligence to generate alerts from the events received *** 3 in 1 (sometimes all three are in one appliance)

Types of Intrusion Detection System NDS – Network Based It is an independent platform which identifies intrusion by examining network traffic and monitors multiple hosts. It gains access to network traffic by connecting to a hub, network switch configured for port mirroring, or network tap. Example : Snort- KSU (Academic Freedom) PIDS – Protocol Based Consists of a system or agent that would typically sit at the front end of a server, monitoring and analyzing the communication protocol between a connected device (a user/PC or system) APIDS – Application Protocol Consists of a system or agent that would typically sit within a group of servers, monitoring and analyzing the communication on application specific protocols. For example; in a web server with database this would monitor the SQL protocol specific to the middleware/business-login as it transacts with the database. HIDS – Host Based Hybrid System

How IDS is implemented?

Host Based Intrusion Detection System Consists of an agent on a host which identifies intrusions by analyzing system calls, application logs, file-system modifications (binaries, password files, capability/acl databases) and other host activities and state. An example of a HIDS is OSSEC

IDS vs. Firewalls Both related to network security. Firewall looks outwardly for intrusions in order to stop them from happening. Firewalls limit access between network to prevent intrusion and do not signal an attack from inside the network. IDS evaluates a suspected intrusion once it has taken place and signals an alarm. IDS watches for attacks that’s originate from within a system.

Passive vs. Reactive Systems In a passive system, the intrusion detection system (IDS) sensor detects a potential security breach, logs the information and signals an alert on the console and or owner. In a reactive system, also known as an Intrusion Prevention System (IPS), the IDS responds to the suspicious activity by resetting the connection or by reprogramming the firewall to block network traffic from the suspected malicious source. They both has signature based systems depends on activity on host or network.(skype) tcp $EXTERNAL_NET 1024: -> $HOME_NET 1024: (msg:"Skype client login -- reply from server"; flags:AP,SUFR12; flow:to_client,established; dsize:5; content:"|17 03 01 00|"; depth:4; sid:1000010; rev:2; )

Prevention System An enemy can send packets that the IPS will see but the target computer will not. For example, the attacker could send packets whose Time to live fields have been crafted to reach the IPS but not the target computers it protects. This technique will result in an IPS with different state than the target. An intrusion prevention system is a network security device that monitors network and/or system activities for malicious or unwanted behavior and can react, in real-time, to block or prevent those activities.

Host Intrusion Prevention System Host-based intrusion prevention system (HIPS): an installed software package which monitors a single host for suspicious activity by analyzing events occurring within that host. They also have signature based system.

How IDS differ from IPS * IPSs are designed to sit inline with traffic flows and prevent attacks in real-time Deep packet inspection; In addition, most IPS solutions have the ability to look at (decode) layer 7 protocols like HTTP, FTP, and SMTP RBIPS(Rate) can identify abnormal rates for certain types of traffic (botnet- zombie-ddos) Ex : Connections per second, packets per connection Attacks are detected when thresholds are exceeded. The thresholds are dynamically adjusted based on time of day, day of the week etc., drawing on stored traffic statistics.

Host-based vs. Network IPS HIPS can handle encrypted and unencrypted traffic equally, because it can analyze the data after it has been decrypted on the host. NIPS does not use processor and memory on computer hosts but uses its own CPU and memory NIPS drawback AND benefit, depending on how you look at it NIPS is a single point of failure, which is considered a disadvantage; however, this property also makes it simpler to maintain. Use failover or load balancing to combat this NIPS disadvantage

Host-based vs. Network IPS - 2 NIPS can detect events scattered over the network (e.g. low level event targeting many different hosts, like a worm) and can react With a HIPS, only the host’s data itself is available to take a decision It would take too much time to report it to a central decision making engine and report back to block.

Importance of HIPS Well known security companies realized how important HIPS and they all published their HIPS products.

Questions????