1. Lesson 8 Intrusion Detection Systems

2. Overview
History
Definitions
Common Commercial IDS
Specialized IDS

3. Why Even Bother?
“One of the problems with anomaly detection is that even the current best research systems have something like a 75% success rate.”
Marcus Ranum
Network Flight Recorder

4. Intrusion Detection Defined
The process of monitoring the events occuring in a computer system or network and analyzing them for signs of intrusions, defined as attempts to compromise the confidentiality, integrity, availability, or to bypass the security mechanisms of a computer or network.

5. General Thoughts about ID
No Defense is Impenetrable
Vulnerabilities exist to bypass system security precautions
Automated tools exist to find and exploit vulnerabilities
A methodology to detect and report suspicious host and network activity must be implemented
IDS Goal: to characterize attack manifestations to positively identify all true attacks without falsely identifying non-attacks
ID is an instance of the general signal detection problem

6. Why use ID? Increase the perceived risk of discovery and punishment
To detect attacks not prevented by other means
Detect and deal with probing
Document existing threats
QC for security design and admin
Forensics for improved security or prosecution

7. Goals of IDS
Accountability - “I can deal with security attacks that occur on my systems as long as I know who did it (and where to find them.)”
Response - “I don’t care who attacks my system as long as I can recognize that the attack is taking place and block it.”

8. History of ID
John Anderson’s: Computer Security Threat Monitoring and Surveillance
Dorothy Denning: An Intrusion Detection Model
Laid groundwork for commercial products
First IDS, circa 1993: USAF ASIM

9. Generic Intrusion Detection Model
Event
Generator
Activity
Profile
Rule Set/
Detection
Engine
CLOCK
Design
New
Profiles
Update
Profile
State
Create Anomaly
Records
Define
new &
modify
existing
rules
Audit trails,
network packets
application logs

10. Model Components
Rule Set - inference engine decides whether an intrusion has occurred or
Generic detector examing events and state data using models, rules, patterns and statistics to flag intrusive behavior
Activity Profile -
Maintains state of system or network being monitored
Feedback critical
No architectural limitations
Rule base can learn if programmed

11. Some Historical IDSes

12. Haystack Preprocessor Statistical Analysis Audit Data Reports
Canonical
Audit trail
9-track Tape
Preprocessor
Statistical Analysis
Z-248 PC
Each record in the CAT file is processed in two ways. Each record is checked to see if it indicates a security relevant event and is logged if it does. Each record is also used to update a database which contains information on the user’s past behavior which is then used to determine if the event is outside of normal activity.
Audit
Data
Reports
Unisys 1100

13. Intrusion Detection Expert System (IDES)
Receiver
Audit Records
Audit
Data
Expert System
Active Data Collector
Active
Data
Anomaly
Data
Profile Updater
Anomaly Detector
Security Admin
Interface
Profile
Data

14. Multics Intrusion Detection and Alerting System (MIDAS)
Command
Monitor
Audit
Records
Preprocessor
Network Interface
Multics
Command monitor captures command data that is not audited by Multics.
Preprocessor filters out data not used by MIDAS and formats the remaining info into an assertion for the fact base.
Facts in the base may bind with a rule found in the rule base to indicated intrusive activity.
Statistical database contains both user and system statistics and defines what normal activity is for Dockmaster (the Midas system).
A fact may indicate activity outside of normal behavior and thus trigger a rule.
Fact Base
Statistical Data Base
System Security
Monitor
Rule Base
Symbolics

15. Network Security Monitor (NSM)
Network Traffic
Packet Catcher
Filter
Object Detector
& analyzer
Report
Generator
Traffic
Archive
Network Profile – which systems normally connect to which others using what service.
During a 2 month period, 110,000 connections analyzed at UC-Davis, NSM correctly
identified over 300 intrusions, only 1% had been detected by admins.

16. Distributed IDS (DIDS)
Unmonitored
host
Monitored
Host
Monitored
Host
DIDS Director
Unmonitored
host
Monitored
Host
LAN Monitor

17. Cooperating Security Monitors (CSM)
Command
Monitor
User
Interface
Other
CSM’s
Local
IDS
CSM
Intruder
Handler

18. Current IDS Trends Much more sophisticated More and more automation
False alarm rates dropping
Evolving into next generation devices
Pairing with Security Incident Event Managers/Data Correlation Tools

19. Type of IDS Signature based system Anomaly based detectors
Attack description that can be matched to sense attack manifestations
Anomaly based detectors
equate “unusual” or “abnormal” as intrusions

20. IDS Classification Can base classification on what they sense
Network based systems (NIDS)
Sense packets on a network segment
Easy to deploy, but they suffer throughout problems
Host-based systems (HIDS)
Inspect audit or log data
Can affect performance on host
Hybrids
Combine the best of both

21. System--Network Based “A Layer in the Defense”
Intrusion Detection
System--Network Based
“A Layer in the Defense”
Adversary
INTERNET
External ROUTER
FIREWALL
Intrusion Detection
System
Other Network
Defense Tools
DMZ Server(s)
INTERNAL
NETWORK

22. Potential Adversaries DMZ Server(s)
External ROUTER
INTERNET
Potential
Adversaries
DMZ Server(s)
FIREWALL
INTERNAL
NETWORK
Special
Enclave

23. Network Based IDS
Some detect intrusions after the bad guy is inside….but at least you know
Others detect attacks (attack detect systems)
Location in architecture determines which one you have
Number of IDSes in architecture can add protetection
Balance comes between being inundated with false alarms or alert conditions requiring action
Ideal NIDs installation: start buy adding as few sensors as possible

24. NIDS PASSIVE Interface to Network Traffic

25. IDS Correlation: Signature & Behavior
Ref: Avi Chesla, ISSA Journal Nov 2005

26. Host based IDS Setup a HIDs like a selective burglar alarm
Deploy HIDs on critical servers devoid of interactive users
Configuration options
Critical file modification
When log files get smaller
Process table grows larger than normal or too fast

27. What the different levels of IDS do
Host-based Intrusion Detection
Will catch users logged directly into a system
Will miss network actions (the network as a whole)
Network-based Intrusion Detection
Will miss individual actions on the host the user is logged directly into.
Will be able to see attacks on multiple hosts (“door knob rattling”).
Where do you place the IDS? On the LAN or on the outside of the router (the connection to the Internet)?

28. Five Functional Areas of HIDS
Log/Event Monitoring
File Integrity
Checking
Policy
Compliance
Network Traffic
Monitoring
System
Monitoring
Ref: Rasmussen, ISSA, Mar 02

29. McAfee HIPS

30. And what about IDS and the PSTN?
Two aspects
Detection of intrusions into the IP network from the PSTN
Detection of intrusions into the PSTN and its systems
Do you
Have a separate system, or
Feed current IDS with data from the PSTN?

31. Strengths of IDSes
Monitor and analysis of system events and user behaviors
Testing security states of system configurations
Recognizing known attack patterns
Recognizing anomalies
Measuring security policy enforcement
Managing Data Flow

32. Weaknesses of IDSes
Compensating for weak or missing security mechanisms
Instantaneous detection, reporting, and attack response
Detecting newly published attacks
Compensating for info source fidelity
Reducing manpower needs

33. IDS Adjusted Expectations
Consider a building with motion detectors
Works great when building is empty
But if activated during day many false positives
Building managers don’t expect them to work during the day
Its possible to set up network-based IDS (NIDS) and a host-based IDS (HIDS) to limit false positives

34. Monitoring and the Law
Issue is expectation of privacy – does the individual have one?
You generally need to inform individuals using the system that their actions are subject to monitoring.
Government systems have the warning banner.
This advice also issued by CERT (CA-92:19) for anybody wanting to monitor keystrokes.
Note that it is considered not enough to notify all authorized users (when they are issued their initial password for example), it must be displayed each time at login.

35. IDS Fad
“ People buy the hottest IDS tool that will be very good about telling them about DOS in the network, but is useless detecting problems inside the host.”
Matt Bishop, UC Davis

36. Detection of Incidents Basic IDS Model-History
Summary
Detection of Incidents
Basic IDS Model-History
IDS Types and Classification