1. Intrusion Detection system
A.Sivaramakrishnan, AP
Department of Informaton Technology
Chettinad Tech.

2. Why IDS. Technology Growth in multiple dimensions
Why IDS? Technology Growth in multiple dimensions Computing power and paradigms Moore’s law Multilayered and internetwork infrastructures ARPANET Morris worm E- technologies

3. Increasing security incidents. Exploiting vulnerabilities
Increasing security incidents Exploiting vulnerabilities CERT (Computer Emergency Response Team ) reports probe, scan account compromise root compromise packet sniffer denial of service exploitation of trust malicious code spoofing Internet infrastructure attacks- port scan, buffer overflow .

5. Vulnerabilities Flaws in software or protocol design Weakness in implementation race conditions in file access non-existent checking of data content and size non-existent checking for success or failure inability to adapt to resource exhaustion incomplete checking of operating environment inappropriate use of system calls re-use of software modules for purposes other than their intended ones Weakness in system and network configuration

6. History Anderson – audit trails from systems contain info for tracking misuse - HIDS Denning – ID model – David Todd - NIDS Commercial dev of ID technologies US air force network - Net Ranger Cisco- calatyst switches 6000, 6500 series – DoS attacks on popular sites

7. Threat management – for early detection - IDS
Threat management – for early detection - IDS Intruder - attempt to gain unauthorized access Basic IDS monitor behavior and traffic detect possible intrusions Sophisticated IDS using DM and AI techniques

8. IDS. visibility tool. protocol analyser for security. engineer
IDS visibility tool protocol analyser for security engineer looks for policy violations, config errors, unauthorized applications, infections.. Monitors process and resources for deviation behavior generates alerts

9. Components Information source
Components Information source host resources(CPU,I/O operations, log files), network traffic, user activity, file activity Analyser engine Check for normality in behavior using threshold detection on attributes of user/ system behavior using statistical measures parametric/nonparametric Response/alert system apply rules to drop traffic , alert port blocking,user logoff, disable accounts, shut down..

10. Desirable features Identify intrusive behavior timely -minimum human intervention not affected by attack -use minimal resources adapt and recognise normal behavior – scalability-low false alarms Deployment HIDS - agent based - antivirus approach -– CPU utilisation and network overhead - may get compromised NIDS - firewall approach – false alarms Hybrid IDS

11. Techniques Misuse based. signatures of known intrusive behavior
Techniques Misuse based signatures of known intrusive behavior quick, easy need to be updated constantly Anomaly based behavior deviation from normal behavior no knowledge of attacks needed new vulnerabilities addressed large false alarms needs extensive training target monitoring stealthy process – over prolonged period of time

12. Limitations DoS attacks, RLU attacks Not sufficient amounts of data for monitoring High speed inspections Encrypted traffic

13. IPS - control tool All deny rules inline between two networks Policy enforcement tools rate limiting tool data leak prevention tool behavior anomaly detection tool UTM – unified threat mgmt system Netscreen, Tipping point, Intruvert, IPS guard

14. Improving Security. Security Policy, Procedures, and Practices
Improving Security Security Policy, Procedures, and Practices risk analysis that identifies the site's assets and threats and cost guidelines for system administrators definition of acceptable use for users challenge/response systems for authentication auditing systems for accountability encryption systems network tools such as firewalls and proxy servers

15. Security Technology To address security concepts of confidentiality, integrity and availability – authentication and authorization one time password firewalls monitoring tools security analysis tools Information Warfare offensive and defensive

16. Future Internetworking Secure Protocols Intelligent Autonomous Agents