1. IDS Intrusion Detection Systems
CERT definition:
A combination of hardware and software that monitors and collects system and network information and analyzes it to determine if an attack or an intrusion has occurred. Some ID Systems can automatically respond to an intrusion.
Two Models
_______ Detection Model
________ Detection Model
database of normal activity
search for deviations
database of malicious signatures
search for matches

2. IDS - What Can It Do?
 Monitor and analyze user/system/network activities
 Audit configuration vulnerabilities
 Assess integrity of critical files
 Recognize patterns of known attacks
 Statistically analyze for abnormal activities
 Respond with warnings and/or actions
 Install decoy servers (honey pots)
 Install vendor patches (some IDS)
false positive
false negative

3. Two Types of IDS Host-based Intrusion Detection System (HIDS)
• Searches for patterns in logs, processes, and/or memory.
• Can check file integrity (MD5)
• Observe network traffic flow
• HID also called ________
Network-based Intrusion Detection System (NIDS)
• Searches for patterns in packets, patterns of packets and packets that
don’t belong.
• Can log results or communicate via SMTP/SNMP
• ____________, analyzers and management consoles
• Reactive sensors might alter router/firewall rules
• More extreme response: throttling, session hijacking

5. Rule-based Appliances
Snort Rules
alert tcp ! /24 any -> /24 111\
( content ... msg ...)
log udp any any -> /24 1:1024
alert tcp any any -> /24
( flags:SF; msg:”possible SYN FIN scan”)
pass icmp any any <> /24 (itype:0)

6. IDS Disadvantages Host-based Intrusion Detection System (HIDS)• • • • •
Network-based Intrusion Detection System (NIDS) • • •
An IDS is another tool in the arsenal.

7. Deployment IDS deployment is only as good as its planning.
- Where are sensors located?
- Who monitors logs?
- How are signatures updated?
- What about response planning?
response team
reporting requirements
responsibilities for incident response
management of event recording
CERT

8. Products Snort Sourcefire Cisco Secure IDS ISS Real Secure IDS SHADOW//
Sourcefire //
Cisco Secure IDS //
ISS Real Secure IDS //
SHADOW //
Tripwire //