91.460.201 & 91.530.202 Selected Topics: Digital Forensics Overview of Intrusion Detection/prevention Xinwen Fu

Outline What is intrusion detection Host, Network & Perimeter Detection The Emergence of Intrusion Prevention Real-World Examples Future Directions By Dr. Xinwen Fu

A Big Picture of Cyber Space TAMU Internet Firewall Intrusion Detection System Router Switch UML By Dr. Xinwen Fu http://www.inmon.com/tutorials/ids.php

What is Intrusion Detection? "a process of identifying and responding to malicious activity targeted at computing and networking resources" Incident occurs: Point-in-Time or Ongoing pre-incident preparation Detection of Incidents Initial Response Formulate Strategy Data Collection Analysis Reporting Investigate the incident Resolution, Recovery, Implement Security Measures CSIRT: Computer Security Incident Team A sensor (an analysis engine) that is responsible for detecting intrusions. This sensor contains decision-making mechanisms regarding intrusions. By Dr. Xinwen Fu

A Brief History of Intrusion Detection 1970s – Rudimentary audit-trail analysis 1980s – Signature-Based expert systems 1990s – Explosion of available IDS systems 2000s Emergence of Active IDS Intrusion Detection and Prevention (IDP) Intrusion Prevention Systems (IPS) Convergence of Technologies Firewall + IDP + Anti-Virus Appliances and Security Switches Host => Network => Perimeter Network based IDS’s can be Signature-Based or Behavior Based. Signature based IDS’s are based on the fact that attacks have certain patterns or signatures. Vendors do updates on this IDS’s similar to Antivirus software makers, when new attacks are discovered, they are added to the signature base. This type is also called rules based IDS. Signature-Based == rules based By Dr. Xinwen Fu

A Sample Intrusion Detection System (IDS) By Dr. Xinwen Fu

Outline What is intrusion detection Host, Network & Perimeter Detection The Emergence of Intrusion Prevention Real-World Examples Future Directions By Dr. Xinwen Fu

Internet Mid-Continent ComCast TAMU UML By Dr. Xinwen Fu

HIDS: Host-Based Intrusion Detection System HIDS resides on a single host system System analyzes: Network packets entering and leaving the host Audit trails and log files on the host Processes and systems running on the host Recent advances in Intrusion Prevention: Protocol enforcement Stack enforcement File checksum monitoring All these attempt to protect against exploitation of software vulnerabilities by buffer overflow or protocol anomalies By Dr. Xinwen Fu

Buffer overflows void main(int argc, char *argv[]) { char buffer[512]; if (argc > 1) strcpy(buffer,argv[1]); } char *strcpy(char *dest, const char *src); DESCRIPTION The strcpy() function copies the string pointed to by src (including the terminating `\0' character) to the array pointed to by dest. The strings may not overlap, and the destination string dest must be large enough to receive the copy. By Dr. Xinwen Fu

What is happening within your code? Stack is used to store local variables and the return address (where your function should return when it finishes) An attacker’s input consists of A malicious code A new return address (pointing to the malicious code) By Dr. Xinwen Fu

Where is the HIDS on the Internet? Mid-Continent ComCast TAMU UML By Dr. Xinwen Fu

NIDS: Network-Based Intrusion Detection System NIDS listens to the entire network segment System analyzes: Network packets passing along the network cable Audit trails and log files sent to NIDS by hosts Processes and systems running on the network hosts Recent advances in Intrusion Prevention: “Active” rules to shutdown connections “Integration” to firewalls to disable attackers “Data Mining” to summarize the events By Dr. Xinwen Fu

Where is the NIDS on the Internet? Mid-Continent ComCast TAMU UML By Dr. Xinwen Fu

PIDS: Perimeter-Based Intrusion Detection System PIDS resides on a gateway/edge router System analyzes: Network packets passing through the gateway Audit trails and log files on the gateway Processes and systems running on the gateway Recent advances in Intrusion Prevention: Actively blocking known malicious attacks Zero-latency blocking By Dr. Xinwen Fu

Where is PIDS on the Internet? Mid-Continent Prairiewave TAMU By Dr. Xinwen Fu

Outline What is intrusion detection Host, Network & Perimeter Detection The Emergence of Intrusion Prevention Real-World Examples Future Directions By Dr. Xinwen Fu

Throughput - Real Time Intrusion Detection Current technology can perform at gigabit speeds To exceed that speed, there are various options: Software Signature sets, based on protocol Optimization; reduction in requirement to scan Hardware Co-processor chips: ASIC (application-specific integrated circuit) or others Faster main processors This is important for host and network IDP But for perimeter IDP, how fast is your ISP link? An ASIC (application-specific integrated circuit) By Dr. Xinwen Fu

The Emergence of Intrusion Prevention If you detect an attack and know it's an attack It seems sensible to block it However, three problems are apparent: False Positives (false alarm) – Blocking normal traffic Denial Of Service – Blocking spoofed hosts Latency – Delays in blocking limit effectiveness Evolution of the technology, and merging of firewall and IDP functionality is solving these problems By Dr. Xinwen Fu

A Big Picture of Intrusion Detection and Prevention Being Together By Dr. Xinwen Fu

Outline What is intrusion detection Host, Network & Perimeter Detection The Emergence of Intrusion Prevention Real-World Examples Future Directions By Dr. Xinwen Fu

SQL Slammer Worm The Fastest Internet Worm in History Time line: July 24th 2002, Microsoft announced vulnerability January 25th 2003, SQL Slammer worm unleashed 05:29:36GMT first detection It infected more than 90 percent of vulnerable hosts within 10 minutes The Worm: 376 byte viral payload in a single UDP packet Infects machines with a single packet over UDP/1434 UDP is a broadcast protocol: Possible to infect multiple hosts with 1 packet By Dr. Xinwen Fu

Hosts infected With Slammer A before-and-after animation showing the number of infected Sapphire hosts in a half-hour period between 05:29 UTC and 06:00 UTC. By Dr. Xinwen Fu http://www.caida.org/research/security/sapphire/

How to stop SQL Slammer? Patch Firewall / VPN: Block UDP/1434 (inbound and outbound) Use a VPN for access to sensitive services Intrusion Detection and Prevention: UDP/1434 is a well known protocol: Well known vulnerability, 6 months before exploit IDP signatures can detect and block exploits of this vulnerability The size of the packet is anomalous behavior Zero-Latency Active IDS/IDP is the only way of blocking this worm By Dr. Xinwen Fu

Outline What is intrusion detection Host, Network & Perimeter Detection The Emergence of Intrusion Prevention Real-World Examples Future Directions By Dr. Xinwen Fu

Future Directions What do you think? By Dr. Xinwen Fu

Intrusion Detection Approach IDS Classification Intrusion Detection Approach Intrusion detection approach Protected Systems Structure Data Sources Behavior after an Attack Analysis Timing HIDS NIDS Hybrids Audit Trail Network Packets System State Analysis (Kernel, Services, File, etc.) On-the-fly Processing Interval Based IDS Anomaly detection Signature detection Centralized System Distributed System Agent System Active IDS Passive IDS By Dr. Xinwen Fu

Terms Anomaly detection: explores issues in intrusion detection associated with deviations from normal system or user behavior Signature detection: discriminates between anomaly or attack patterns (signatures) and known intrusion detection signatures (also called rules based detection) HIDS: uses information derived from a single host NIDS: exploits information obtained from a whole segment of a local network Passive IDS: simply generate alerts and log network packets Active IDS: detect and respond to attacks, attempt to patch software holes before getting hacked or act proactively by logging out potential intruders, or blocking services By Dr. Xinwen Fu

References Przemyslaw Kazienko & Piotr Dorosz, Intrusion Detection Systems (IDS) Part I - (network intrusions; attack symptoms; IDS tasks; and IDS architecture), http://www.windowsecurity.com/pages/article_p.asp?id=1147, Apr 07, 2003 Przemyslaw Kazienko & Piotr Dorosz, Intrusion Detection Systems (IDS) Part 2 - Classification; methods; techniques, http://www.windowsecurity.com/pages/article_p.asp?id=1335, Jun 15, 2004 Cisco IDS Solution, http://www.cisco.com/en/US/netsol/ns340/ns394/ns171/networking_solutions_audience_business_benefit09186a008033a458.html, 2005 Randy Stauber, Defense In Depth, http://www.infosecwriters.com/texts.php?op=display&id=170, 19/05/04 By Dr. Xinwen Fu

Cat with Boots By Dr. Xinwen Fu