IIT Indore © Neminah Hubballi Intrusion Detection Dr. Neminath Hubballi IIT Indore © Neminah Hubballi

IIT Indore © Neminah Hubballi Intrusion When a user of an information system takes an action that; that user is not legally allowed to take, it is called intrusion. It attempts to compromise Confidentiality Integrity and/or Availability of a system resource. A second line of defense. The first one being intrusion prevention systems. can identify classes of intruders: Spoofing Illegal logins Worm propagations IIT Indore © Neminah Hubballi

IIT Indore © Neminah Hubballi Intrusion Detection Intrusion detection: Monitor the system execution for security violations and take corrective measures when a violation is detected. It involves determining that some entity has attempted or worse gained access to the system resources in a non diplomatic way. IIT Indore © Neminah Hubballi

IIT Indore © Neminah Hubballi IDS Taxonomy Detection Method: Characteristics of analyzer Behavior Based: uses info about normal behavior. Knowledge based: uses info about attacks. Behavior on Detection: the response of system Passive alerting. Active response. Audit source location: Host log files. Network packets. Usage frequency: Continuous monitoring Periodic monitoring IIT Indore © Neminah Hubballi

IIT Indore © Neminah Hubballi Host Based IDS Concerned about security of a single machine. Typically works by protecting the file system and other key data structures change detection. Uses the log information of system for analysis. Ex: syslog With some modification to OS kernel the IDS can be made to look into system calls and model them for intrusion detection. Tripwire is an example of the kind. IIT Indore © Neminah Hubballi

IIT Indore © Neminah Hubballi State Modeling Encodes the behavior as a set of states. An action in the system triggers the movement to next state. The state of a system is a function of all the users, processes, and data present at a given time. The system starts in a state representing the normal behavior and each illegal event takes it towards the state representing the intrusion. IIT Indore © Neminah Hubballi

Generic State Transition Diagram Sate Modeling Generic State Transition Diagram IIT Indore © Neminah Hubballi

Signature Based Detection General view Network Analysis Backend NIDS Sensor Packets Alerts Signature Database IIT Indore © Neminah Hubballi

Rule-Based Intrusion Detection Snort and Bro Ex1: log tcp any any -> 192.168.1.0/24 !6000:6010 Ex 2: alert icmp any any -> any any (msg: "Ping with TTL=100"; \ ttl: 100;) Ex 3: alert ip any any -> 192.168.1.0/24 any (content-list: \ "porn"; msg: "Porn word matched";) IIT Indore © Neminah Hubballi

IIT Indore © Neminah Hubballi Anomaly Detection Builds models of normal behavior, and automatically detects any deviation from it Collect data and determine the pattern of legitimate user Threshold detection Define thresholds for frequency of occurrence of events Profile based detection Develop profile of activity for each user. IIT Indore © Neminah Hubballi

Anomaly Detection Methods Statistical approach. A simple statistical count of activities decides the boundary of normal and abnormal. Relatively old method of IDS technology. Vague definition of system behavior but are still relevant. Number of false alarms if the system behavior is changing frequently. IIT Indore © Neminah Hubballi

Anomaly Detection Methods cont.. Machine learning techniques Classification: decision tree, SVM, neural network, fuzzy logic, etc. Clustering: based on the assumption that the normal and abnormal behaviors fall into two different clusters, hence grouping them is very easy. Hybrid: combining different classification techniques with an ambitious objective of achieving better classification efficiency. IIT Indore © Neminah Hubballi

IIT Indore © Neminah Hubballi IDS Terminology True Positive (TP): when the attack succeeded and the IDS was able to detect it (Success & Detection) True Negative (TN): when the attack failed and the IDS did not report on it (¬Success & ¬Detection) False Positive (FP): when the attack failed and the IDS reported on it (¬Success & Detection) False Negative (FN): when the attack succeeded and the IDS was not able to detect it (Success & ¬Detection) IIT Indore © Neminah Hubballi

Performance Metrics for IDS Accuracy: the proper detection of attacks and the absence of false alarms Performance: the rate at which traffic and audit events are processed To keep up with traffic, may not be able to put IDS at network entry point Instead, place multiple IDSs downstream Fault tolerance: resistance to attacks Should be run on a single hardened host that supports only intrusion detection services Timeliness: time elapsed between intrusion and detection IIT Indore © Neminah Hubballi

Characterizing the IDS Effectiveness Efficiency Ease of use Security Interoperability Indian Institute of Technology Guwahati IIT Indore © Neminah Hubballi 22-04-2017

IIT Indore © Neminah Hubballi Base Rate Fallacy Hypothesize a figurative computer network with Tens of workstations A few servers Few dozens of users 1000000 audit records per day. 1 or 2 attempted attacks per day. 10 audit records per attack. IIT Indore © Neminah Hubballi

Bayesian Detection Rate True positive rate : False positive rate : False negative rate : True negative rate : Our interest is to Bayesian detection rate : Absence of an alarm i.e., has nothing to worry. IIT Indore © Neminah Hubballi

Bayesian Detection Rate IIT Indore © Neminah Hubballi

IDS Historical perspective IIT Indore © Neminah Hubballi