1. Intrusion Detection Systems: A Survey and Taxonomy A presentation by Emily Fetchko

2. About the paper By Stefan Axelson of Chalmers University of Technology, Sweden From 2000 Cited by 92 (Google Scholar) Featured on InfoSysSec Used in Network Security (691N) Followup to 1999 IBM paper “Towards a Taxonomy of Intrusion Detection Systems”

3. Outline New and Significant What is a taxonomy? Introduction to IDS Introduction to classification Taxonomy by Intrusion Detection Principle Example systems Taxonomy by System Characteristics Trends in Research and Conclusion

4. New and Significant First taxonomy paper Predicts research areas for Intrusion Detection Followup to 93 page survey report of research and IBM paper

5. What is a taxonomy? “either a hierarchical classification of things, or the principles underlying the classification” (Wikipedia) Serves three purposes –Description –Prediction –Explanation

6. Intrusion Detection Systems Compare them to burglar alarms Alarm/siren component –Something that alerts Security officer/response team component –Something to respond/correct Different from perimeter defense systems (such as a firewall)

7. Types of intrusions Masquerader –Steals identity of user Legitimate users who abuse the system Exploits –Trojan horse, backdoor, etc. And more

8. Two major types of detection Anomaly detection –“abnormal behavior” –May not be undesirable behavior –High false positive rate Signature detection –Close to previously-defined bad behavior –Has to be constantly updated –Slow to catch new malicious behavior

9. Approaches to classfication Type of intrusion detected Type of data gathered Rules to detect intrusion

10. Taxonomy by Intrusion Detection Principles “self-learning” –Trains on “normal” behavior “programmed” –User must know difference between normal & abnormal “signature inspired” –Combination of anomaly and signature methods

11. Anomaly detection Time series vs. non time series Rule modeling –Create rules describing “normal behavior” –Raise alarm if activity does not match rules Descriptive statistics –Compute distance vector between current system statistcs and “normal” stats ANN – Artificial Neural Network –Black box modeling approach

12. Anomaly detection, continued Descriptive Statistics –Collect statistics about parameters such as #logins, #connections, etc. –Simple statistics – abstract –Rule-based –Threshold Default Deny –Define safe states –All other states are “deny” states

13. Signature Detection State-modeling –If the system is in this state (or followed a series of states) then an intrusion has occurred –Petri-net – states form a petri net, a type of directed bipartite graph (place vs transition nodes)

14. Signature Detection, continued Expert system –Reasoning based on rules –Forward-chaining most popular String-matching –Look for text transmitted Simple rule-based –Less advanced but speeder than expert system

15. Signature Inspired Detection Only one system in the taxonomy (Signature Inspired and Self Learning) Automatic feature selection –Automatically determines which features are interesting –Isolate, use them to decide if intrusion or not

16. Classification by Type of Intrusion Well-known intrusions –Correspond to signature detection systems Generalized intrusions –Like a well-known intrusion, but with some parameters left blank –Correspond to signature-inspired detectors Unknown intrusions –Correspond to anomaly detectors

17. Effectiveness of Detection Two categories marked as least effective Anomaly – Self Learning – Non-time series –Weak in collecting statistics on normal behavior –Will create many false positives Anomaly – Programmed – Descriptive Statistics –If attacker knows stats used, can avoid them –Leads to false negatives

18. Taxonomy by System Characteristics Define system beyond the detection principle Time of detection –Real time or non real time Granularity of data processing –Continuous or batch Source of audit data –Network or host

19. System Characteristics, continued Response to detected intrusions –Active or passive –Modify attacked or attacking system Locus of data processing –Centralized or distributed Locus of data collection Security (ability to defend against direct attack) Degree of interoperability –Work with other systems –Accept other forms of data

20. Example Systems Haystack, 1988 –Air Force –Anomaly detection based on per user profile, and user group profile –Signature based detection MIDAS, 1988 –National Computer Security Centre and Computer Science Laboratory, SRI International –Heuristic intrusion detection –Expert system with two-tiered rule base

21. Example Systems, continued IDES – Intrusion Detection Expert System, 1988-1992 –Multiple authors, long term effort –Real time expert system with statistics –Compare current profile with known profile –Distinction between “on” and “off” days –NIDES = next generation IDES NSM – Network Security Monitor –Monitors broadcast traffic –Layered approach – connection & lower layers –Profile by protocol (telnet, etc)

22. Example Systems, continued DIDS – Distributed IDS, 1992 –Incorporates Haystack and NSM –Three components: Host monitor, LAN monitor, DIDS director –DIDS director contains expert system Bro, 1998 –Network-based (with traffic analysis) –Custom scripting language –Prewritten policy scripts –Signature matching –Action after detection –Snort compatibility

23. System Characteristics, continued

24. System characteristics, continued

25. Trends in Research Active response –Legal ramifications, however Distributed detection –Corresponds with distributed computing in general Increased security Increased interoperability

26. Opportunities for Further Research Taxonomies by other classifications Signature – self-learning detectors Two tiered detectors False positive rates for anomaly detectors Active response detectors Distributed detectors High security detectors

27. Bibliography Stefan Axelson. “Intrusion Detection Systems: A Survey and Taxonomy”. Chalmers University of Technology, Sweden, 2000. Debar, Decier and Wespi. “Towards a taxonomy of intrusion-detection systems”. Computer Networks, p805-822, 1999. Bro Intrusion Detection System, www.bro- ids.orgwww.bro- ids.org Google Scholar, http://scholar.google.comhttp://scholar.google.com