Presentation on theme: "CONTEXT-BASED INTRUSION DETECTION USING SNORT, NESSUS AND BUGTRAQ DATABASES Presented by Frédéric Massicotte Communications Research Centre Canada Department."— Presentation transcript:
CONTEXT-BASED INTRUSION DETECTION USING SNORT, NESSUS AND BUGTRAQ DATABASES Presented by Frédéric Massicotte Communications Research Centre Canada Department of Systems and Computer Engineering, Carleton University Privacy, Security and Trust October 2005
Motivations Current IDS Problems –Some IDS do not provide a declarative rule specification language Difficult to verify, compare and update attack scenarios –Many IDS only rely on one packet or on one TCP stream to identify intrusions More complex attacks need to be programmed (two specification systems) False negatives and false positives –Intrusion signatures do not include a precise network context Increases the number of false positives (session state not enough) IDS functionality needed –The IDS signature language should be a declarative rule specification language be independent of the monitoring engine enable multi-packet rules specify network-context gathering other than alarms and session states be used on well-defined models (Packet Model and Network Model) –The IDS monitoring engine should be multi-packet maintain a network-context knowledge base
Our Contributions A multi-packet monitoring engine A declarative rule specification language that uses the Object Constraint Language A formal packet model and a formal network model A library of passive information gathering rules to acquire the network context Missing : –A library of intrusion detection rules with network context Prove that these rules could be used to reduce the number of false positives Study the correlation potential and accuracy of freely available security databases
Rule Specification ?OCL Packet Stream Model Network Model alarmpacket
Results of Relationship Analysis Only 16% of the Snort rules have references to Bugtraq and Nessus. –Only 11.4% have the same set of Bugtraq references whether we use the Snort to Bugtraq references or the Snort to Nessus to Bugtraq references. –29% of the Group 1 Snort rules present discrepancies, depending on whether we use the direct or indirect relationship to Bugtraq. –6% of Group 1 seem to refer to different Bugtraq vulnerabilities.
Results Built a library of small IDS rules with network context using group 1 Snort rules Tested 20 attack programs against 12 systems –Reduced the number of false positives, compared to Snort –Proved that network context is important to reduce false positives
Test Cases Attacker 1Attacker 2 Attack Snort 2.4.18- 14 Linux 2..4.19- 4GB OS X Sun 4.x PNMT Attack Results Oracle vs
Conclusion The relationships between Snort IDS signatures, Nessus and Bugtraq still need to be improved Correlation systems using events for these systems only use a small proportion of relationship potential For the small number of Snort rules that provide accurate relationships, network context is important to reduce false positives. Future Work on IDS Rules –Test more context-based intrusion detection rules –Continue the development of a virtual exploit testing network –Test rules to identify more complex attacks such as DDOS and Network Discovery Techniques
Your consent to our cookies if you continue to use this website.