Intrusion Detection System(IDS)
- 3. Technologies
- 5. History
- 6. Need of IDS
- 7. Classification of IDSWhat is IDS?Revolution in networking
- 8. The possibilities and opportunities are limitless.
- 9. Unfortunately, so too are the risks and chances of malicious activities.Intrusion=Illegal entry or unwelcome addition
- 10. Definition: Intrusion Detection System (IDS) is a software to determine if a computer network or server has experienced an unauthorized intrusion.
- 11. IDS detects these intrusion attempts so that action may be takento repair the damage later. IDS monitors network traffic and monitors for suspicious activity and alerts the system or network administrator.
- 12. The beginning(History)A USAF paper published in October 1972 written by James P. Anderson outlined the fact the USAF had “become increasingly aware of computer security problems.”
- 13. Before designing an IDS, it was necessary to understand the types of threats and attacks that could be mounted against computers systems.A computer system should provide confidentiality, integrity and assuranceagainst denial of service.
- 14. Confidentiality:Whether the information stored on a system is protected against unauthorized access.Need of IDS
- 15. Integrity: Whether the information stored on a system is reliable and can be trusted.Increased connectivity: (especially on the Internet) more and more systems are subject to attack by intruders.
- 16. These intruders attempts try to exploit flaws in the OS as well as in application programs and have resulted in spectacular incidents.
- 17. Internet Worm incident of 1988.Two ways to handle
- 18. we cannot prevent intruders,we should at least try to detect it and prevent similar attacks in future.Types of intruders
- 19. Tasks to be performedSimulationAnalysisNotification
- 21. Technologies:
- 22. Network Intrusion detection systemDetect attacks as they happen
- 23. Real-time monitoring of networks
- 24. Provide information about attacks that have succeeded
- 25. Forensic analysisDeploying sensors at strategic locations
- 26. E.G., Packet sniffing via tcpdump at routers
- 28. Watch for violations of protocols and unusual connection patterns
- 30. Look into the data portions of the packets for malicious command sequences
- 31. May be easily defeated by encryptionData portions and some header information can be encryptedThe decryption engine still there.
- 32. Related Tools for Network IDS While not an element of Snort, Ethereal is the best open source GUI-based packet viewer
- 34. Windows
- 36. Red Hat Linux RPMs: ftp.ethereal.com/pub/ethereal/rpms
- 37. Requirements of NIDSHigh-speed, large volume monitoring
- 38. No packet filter drops
- 40. Mechanism separate from policy
- 41. Extensible
- 43. Economy in resource usage
- 45. Resilience to attacks upon the IDS itself!Host Intrusion Detection SystemUsing OS auditing mechanisms
- 46. E.G., BSM on Solaris: logs all direct or indirect events generated by a user
- 47. strace for system calls made by a program
- 49. E.G., Analyze shell commandsMonitoring executions of system programs
- 50. E.G., Analyze system calls made by sendmail
- 51. A HIDS can see more than just network traffic and can make decisions based on local settings, settings specific to an OS, and log data.
- 53. Signature based idsSniff traffic on network
- 54. border router or multiple sensors within a LAN
- 55. Match sniffed tracffic with signatures
- 56. attack signatures in database
- 57. Signature: set of rules pertaining to a typical intrusion activity
- 58. Simple example rule: any ICMP packet > 10,000 bytes
- 59. Example: more than one thousand SYN packets to different ports on same host under a secondskilled security engineers research known attacks; put them in database
- 60. can configure IDS to exclude certain signatures; can modify signature parameters
- 61. Warn administrator when signature matches.
- 62. send e-mail, SMS
- 63. send message to network management systemLimitations to signature detectionRequires previous knowledge of attack to generate accurate signature
- 64. Blind to unknown attacks
- 65. Signature bases are getting larger
- 66. Every packet must be compared with each signature
- 67. IDS can get overwhelmed with processing; can miss packetsAnomaly Detection IDSObserve traffic during normal operation
- 68. Create normal traffic profile
- 69. Look for packet streams that are statistically unusual
- 70. e.g., inordinate percentage of ICMP packet
- 71. or exponential growth in port scans/sweeps
- 72. Doesn’t rely on having previous knowledge of attack
- 73. Research topic in security