1. Profile-Based Web Intrusion Prevention System by Donovan Thorpe CS526 Fall 2002

2. Introduction Intrusion Detection System (IDS) Profile-Based: profile of normal activity Profile-Based: profile of normal activity Signature-Based: pattern of malicious activity Signature-Based: pattern of malicious activityGoal: Profile-Based Intrusion Prevention System A system the prevents (drops) packets that are flagged as abnormal.

3. Security for Web Servers Current Security: Firewalls, IDS and Patch & Update frequently Firewalls, IDS and Patch & Update frequently Current Problems: Vulnerability Scripts, Virus and Worms Vulnerability Scripts, Virus and Worms Corporat e network IDS Sensor Firewall Web Servers IDS Sensor Untruste d network

4. Profile-Based Web Intrusion Prevention System Content Switch Content Switch Web based content switch: port 80 Web based content switch: port 80 Rules Rules Define what is normal and abnormal Define what is normal and abnormal Types of rules Types of rules Rules based at Directory level Rules based at File level Update rules Update rules Periodically: every 10, 30, 60 minutes Periodically: every 10, 30, 60 minutes Dynamically: update though a socket, file or db Dynamically: update though a socket, file or db

5. Intrusion Prevention System (cont.) Corporat e network Untruste d network A script catalogs the web servers file system and makes rules based on that catalog. Content Switch Rule Module Web Servers Content Switch talks to Rule module about each packet.

6. The Rules Crontab starts a script makes a catalog of the web servers file system. From that catalog it makes an allow rule for each file or directory. Add in White List at beginning of rules. Add in “else” or “default” reject rule at the end of rules. Adds new rules to the rule module

7. Example Case: Directory of web server Generated rules

8. Results + Directory or file listing is very easy to script + Rule file can be created on web server or rule module system - Re-compile the rule module, Kill the process and then start the rule module. - Take input from a file or through a socket - Handle regular expressions for rules

9. References CISCO Security and VPN Software http://www.cisco.com/en/US/products/sw/secursw/ http://www.cisco.com/en/US/products/sw/secursw/ Linux Secure Content Switch http://cs.uccs.edu/~chow/pub/master/gkgodava/doc/ Content Switch Rules and Their Conflict Detection http://cs.uccs.edu/~chow/pub/conf/pdcat/crv-n320.pdf