1. 1 Intrusion Detection Methods “Intrusion detection is the process of identifying and responding to malicious activity targeted at computing and networking resources.”

2. 2 The Seven Fundamentals 1.What are the methods used 2.How are IDS Organized 3.What is an intrusion 4.How do we trace and how do they hide 5.How do we correlate information 6.How can we trap intruders 7.Incident response

3. 3 It is possible to associate a packet with a human initiator?

4. 4 Why is hiding on the Internet easy? Spoofed source addresses Changing installed address Dynamic address allocation Anonymous entry points Anonymizing services Daisy-chain connections Cryptographic anonymity Hacker advice

5. 5 Self test Please read Blind signature based E-cash, Page 133 Next class: –What are the possible attacks on this scheme? –Build the associated attack tree

6. 6 The trace back workbench Finger Ph Ping Traceroute Rusers Nslookp/Dig/host Whois Phone records and caller id Internet directories Reverse hacking! Traceback traps

7. 7 Self test Please read “Internet Cookies,” Page 140 Next class: –Discussion on the cookies issue.