Chapter 9 INTRUDERS MSc. NGUYEN CAO DAT Dr. TRAN VAN HOAI.

Slides:



Advertisements
Similar presentations
Lecture 6 User Authentication (cont)
Advertisements

Network Security Essentials Chapter 9 Fourth Edition by William Stallings Lecture slides by Lawrie Brown.
Lecture 13 Intrusion Detection modified from slides of Lawrie Brown.
Cryptography and Network Security Chapter 20 Intruders
1 Ola Flygt Växjö University, Sweden Intruders.
Informationsteknologi Thursday, October 11, 2007Computer Systems/Operating Systems - Class 161 Today’s class Security.
Cryptography and Network Security Chapter 18 Fourth Edition by William Stallings.
EECS Presentation Web Tap: Intelligent Intrusion Detection Kevin Borders.
1 Intrusion Detection CSSE 490 Computer Security Mark Ardis, Rose-Hulman Institute May 4, 2004.
Lesson 13-Intrusion Detection. Overview Define the types of Intrusion Detection Systems (IDS). Set up an IDS. Manage an IDS. Understand intrusion prevention.
Intrusion detection Anomaly detection models: compare a user’s normal behavior statistically to parameters of the current session, in order to find significant.
Cryptography and Network Security Third Edition by William Stallings Lecture slides by Lawrie Brown.
seminar on Intrusion detection system
Lecture 11 Intrusion Detection (cont)
Intrusion Detection. Intruders Classes (from [ANDE80]: Classes (from [ANDE80]: two most publicized threats to security are malware and intruders two most.
Intruders significant issue for networked systems is hostile or unwanted access either via network or local can identify classes of intruders: –masquerader.
Cryptography and Network Security Chapter 20 Fifth Edition by William Stallings Lecture slides by Lawrie Brown.
Cryptography and Network Security Chapter 20 Fifth Edition by William Stallings Lecture slides by Lawrie Brown.
Cryptography and Network Security Chapter 20. Chapter 20– Intruders They agreed that Graham should set the test for Charles Mabledene. It was neither.
Intrusion Detection for Grid and Cloud Computing Author Kleber Vieira, Alexandre Schulter, Carlos Becker Westphall, and Carla Merkle Westphall Federal.
IIT Indore © Neminah Hubballi
Improving Intrusion Detection System Taminee Shinasharkey CS689 11/2/00.
Cryptography and Network Security Chapter 18 Fourth Edition by William Stallings.
1 Chapter 9 Intruders. 2 Chapter 9 - Intruders significant issue for networked systems is hostile or unwanted access either via network or local can identify.
Chapter 18 Intruders.
Lecture 10 Intrusion Detection modified from slides of Lawrie Brown.
Chapter 18. Intruders. 2 Intruders  Three classes of intruders  Masquerader  likely to be an outsider  penetrates a system’s access controls to exploit.
29.1 Lecture 29 Security I Based on the Silberschatz & Galvin’s slides And Stallings’ slides.
1 Lecture 8: Authentication of People what you know (password schemes) what you have (keys, smart cards, etc.) what you are (voice recognition, fingerprints,
Intrusion Control. CSCE Farkas2 Readings Lecture Notes Pfleeger: Chapter 7.5.
Data Security and Encryption (CSE348) 1. Lecture # 26 2.
NS-H /11041 Intruder. NS-H /11042 Intruders Three classes of intruders (hackers or crackers): –Masquerader –Misfeasor –Clandestine user.
INTRUDERS BY VISHAKHA RAUT TE COMP OUTLINE INTRODUCTION TYPES OF INTRUDERS INTRUDER BEHAVIOR PATTERNS INTRUSION TECHNIQUES QUESTIONS ON INTRUDERS.
HIPS Host-Based Intrusion Prevention System By Ali Adlavaran & Mahdi Mohamad Pour (M.A. Team) Life’s Live in Code Life.
Kittiphan Techakittiroj (25/10/58 12:06 น. 25/10/58 12:06 น. 25/10/58 12:06 น.) Intrusion Detection System Kittiphan Techakittiroj
Password authentication Basic idea –User has a secret password –System checks password to authenticate user Issues –How is password stored? –How does system.
Second Line Intrusion Detection Using Personalization DISA Sponsored GWU-CS.
1 Chapter 9 Intruders. 2 Outline Intruders –Intrusion Techniques –Password Protection –Password Selection Strategies –Intrusion Detection Statistical.
Identification Authentication. 2 Authentication Allows an entity (a user or a system) to prove its identity to another entity Typically, the entity whose.
Lecture 5 User Authentication modified from slides of Lawrie Brown.
Chapter 9 Intruders.
CS526: Information Security Chris Clifton November 25, 2003 Intrusion Detection.
Lecture 15 Page 1 CS 236 Online Evaluating Running Systems Evaluating system security requires knowing what’s going on Many steps are necessary for a full.
Approaches to Intrusion Detection statistical anomaly detection – threshold – profile based rule-based detection – anomaly – penetration identification.
Chapter 6 : Network Security Lecture #1-Week 10 Dr.Khalid Dr. Mohannad Information Security CIT 460 Information Security Dr.Khalid Dr. Mohannad 1.
Computer Security: Principles and Practice First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Chapter 17 – IT Security.
Chapter 9 Intruders.
Intruders By Dr. Shadi Masadeh.
Network Security Essentials
Intrusion Control.
Identification and Authorization
Cryptography and Network Security Chapter 18
Cryptography and Network Security
Outline Introduction Characteristics of intrusion detection systems
NET 311 Information Security
Cryptography and Network Security Chapter 20
NET 412 Network Security protocols
NET 412 Network Security protocols
Chapter 9 Intruders.
Intrusion Detection Systems
Lecture 8: Intrusion Detection
Intrusion Detection system
Cryptography and Network Security Chapter 20 Intruders
Cryptography and Network Security Chapter 18
Cryptography and Network Security Chapter 18
Intrusion.
Lecture 7: Intrusion Detection
Presentation transcript:

Chapter 9 INTRUDERS MSc. NGUYEN CAO DAT Dr. TRAN VAN HOAI

BK TP.HCM Intruders  significant issue for networked systems is hostile or unwanted access  either via network or local  can identify classes of intruders: ▫ masquerader ▫ misfeasor ▫ clandestine user  varying levels of competence

BK TP.HCM Intruders  clearly a growing publicized problem ▫ from “Wily Hacker” in 1986/87 ▫ to clearly escalating CERT stats  may seem benign, but still cost resources  may use compromised system to launch other attacks  awareness of intruders has led to the development of CERTs

BK TP.HCM Intrusion Techniques  aim to gain access and/or increase privileges on a system  basic attack methodology ▫ target acquisition and information gathering ▫ initial access ▫ privilege escalation ▫ covering tracks  key goal often is to acquire passwords  so then exercise access rights of owner

BK TP.HCM Password Guessing  one of the most common attacks  attacker knows a login (from /web page etc)  then attempts to guess password for it ▫ defaults, short passwords, common word searches ▫ user info (variations on names, birthday, phone, common words/interests) ▫ exhaustively searching all possible passwords  check by login or against stolen password file  success depends on password chosen by user  surveys show many users choose poorly

BK TP.HCM Password Capture  another attack involves password capture ▫ watching over shoulder as password is entered ▫ using a trojan horse program to collect ▫ monitoring an insecure network login  eg. telnet, FTP, web, ▫ extracting recorded info after successful login (web history/cache, last number dialed etc)  using valid login/password can impersonate user  users need to be educated to use suitable precautions/countermeasures

BK TP.HCM Intrusion Detection  inevitably will have security failures  so need also to detect intrusions so can ▫ block if detected quickly ▫ act as deterrent ▫ collect info to improve security  assume intruder will behave differently to a legitimate user ▫ but will have imperfect distinction between

BK TP.HCM Approaches to Intrusion Detection  statistical anomaly detection ▫ threshold ▫ profile based  rule-based detection ▫ anomaly ▫ penetration identification

BK TP.HCM Audit Records  fundamental tool for intrusion detection  native audit records ▫ part of all common multi-user O/S ▫ already present for use ▫ may not have info wanted in desired form  detection-specific audit records ▫ created specifically to collect wanted info ▫ at cost of additional overhead on system

BK TP.HCM Statistical Anomaly Detection  threshold detection ▫ count occurrences of specific event over time ▫ if exceed reasonable value assume intrusion ▫ alone is a crude & ineffective detector  profile based ▫ characterize past behavior of users ▫ detect significant deviations from this ▫ profile usually multi-parameter

BK TP.HCM Audit Record Analysis  foundation of statistical approaches  analyze records to get metrics over time ▫ counter, gauge, interval timer, resource use  use various tests on these to determine if current behavior is acceptable ▫ mean & standard deviation, multivariate, markov process, time series, operational  key advantage is no prior knowledge used

BK TP.HCM Rule-Based Intrusion Detection  observe events on system & apply rules to decide if activity is suspicious or not  rule-based anomaly detection ▫ analyze historical audit records to identify usage patterns & auto-generate rules for them ▫ then observe current behavior & match against rules to see if conforms ▫ like statistical anomaly detection does not require prior knowledge of security flaws

BK TP.HCM Rule-Based Intrusion Detection  rule-based penetration identification ▫ uses expert systems technology ▫ with rules identifying known penetration, weakness patterns, or suspicious behavior ▫ compare audit records or states against rules ▫ rules usually machine & O/S specific ▫ rules are generated by experts who interview & codify knowledge of security admins ▫ quality depends on how well this is done

BK TP.HCM Base-Rate Fallacy  practically an intrusion detection system needs to detect a substantial percentage of intrusions with few false alarms ▫ if too few intrusions detected -> false security ▫ if too many false alarms -> ignore / waste time  this is very hard to do  existing systems seem not to have a good record

BK TP.HCM Distributed Intrusion Detection  traditional focus is on single systems  but typically have networked systems  more effective defense has these working together to detect intrusions  issues ▫ dealing with varying audit record formats ▫ integrity & confidentiality of networked data ▫ centralized or decentralized architecture

BK TP.HCM Distributed Intrusion Detection - Architecture

BK TP.HCM Distributed Intrusion Detection – Agent Implementation

BK TP.HCM Honeypots  decoy systems to lure attackers ▫ away from accessing critical systems ▫ to collect information of their activities ▫ to encourage attacker to stay on system so administrator can respond  are filled with fabricated information  instrumented to collect detailed information on attackers activities  single or multiple networked systems  cf IETF Intrusion Detection WG standards

BK TP.HCM Password Management  front-line defense against intruders  users supply both: ▫ login – determines privileges of that user ▫ password – to identify them  passwords often stored encrypted ▫ Unix uses multiple DES (variant with salt) ▫ more recent systems use crypto hash function  should protect password file on system

BK TP.HCM Password Studies  Purdue many short passwords  Klein many guessable passwords  conclusion is that users choose poor passwords too often  need some approach to counter this

BK TP.HCM Managing Passwords - Education  can use policies and good user education  educate on importance of good passwords  give guidelines for good passwords ▫ minimum length (>6) ▫ require a mix of upper & lower case letters, numbers, punctuation ▫ not dictionary words  but likely to be ignored by many users

BK TP.HCM Managing Passwords - Computer Generated  let computer create passwords  if random likely not memorisable, so will be written down (sticky label syndrome)  even pronounceable not remembered  have history of poor user acceptance  FIPS PUB 181 one of best generators ▫ has both description & sample code ▫ generates words from concatenating random pronounceable syllables

BK TP.HCM Managing Passwords - Reactive Checking  reactively run password guessing tools ▫ note that good dictionaries exist for almost any language/interest group  cracked passwords are disabled  but is resource intensive  bad passwords are vulnerable till found

BK TP.HCM Managing Passwords - Proactive Checking  most promising approach to improving password security  allow users to select own password  but have system verify it is acceptable ▫ simple rule enforcement (see earlier slide) ▫ compare against dictionary of bad passwords ▫ use algorithmic (markov model or bloom filter) to detect poor choices

BK TP.HCM Summary  have considered: ▫ problem of intrusion ▫ intrusion detection (statistical & rule-based) ▫ password management