1. Kittiphan Techakittiroj (25/10/58 12:06 น. 25/10/58 12:06 น. 25/10/58 12:06 น.) Intrusion Detection System Kittiphan Techakittiroj engktc@au.ac.th

2. Kittiphan Techakittiroj (25/10/58 12:06 น. 25/10/58 12:06 น. 25/10/58 12:06 น.) Intrusion Detection System Monitioring the Network Activities Detect the sign of intrusion The earlier we detect, the faster we prevent, the more secure we have. Not 100% correct detection –high false alarm, less intrusion, annoying user –less false alarm, high instrusion

3. Kittiphan Techakittiroj (25/10/58 12:06 น. 25/10/58 12:06 น. 25/10/58 12:06 น.) Characteristic of Intruders Masquerader (mostly outsider) –un-authorized user of the system Misfeasor (mostly insider) –authorized user access un-authroized resources –authorized user misuses priveleges Clandestine user –un-authorized user who gain the supervisory priveleges to alter the system (audit, access) IDS: Intrusion Detection Systems

4. Kittiphan Techakittiroj (25/10/58 12:06 น. 25/10/58 12:06 น. 25/10/58 12:06 น.) Type of IDS Audit Records –log files investigation Statistical Anomaly Detection –Statistical based technique Rule-Based Intrusion Detection –Specify a sequence of action or event to indicate the intrusion IDS: Intrusion Detection Systems

5. Kittiphan Techakittiroj (25/10/58 12:06 น. 25/10/58 12:06 น. 25/10/58 12:06 น.) Audit Records Fundamental Tool Investigate the ongoing activity Two basic strategy –Native audit records: standard log files or user accounting information on many OS. –Detection-specific audit records: special software to monitor specific activities. Examples of record information are Subject, Action, Object, Exception- Condition, Resource-Usage, Time-stamp IDS: Intrusion Detection Systems

6. Kittiphan Techakittiroj (25/10/58 12:06 น. 25/10/58 12:06 น. 25/10/58 12:06 น.) Statistical Anomaly Detection Analysis statistical data Any un-usual changes, indicate the sign of instrusion Some metrics or statistical data –Counter (increment): login period, failure login –Guage: logical connection, user processes –Interval Timer: time between two related events –Resource Utilization: CPU times, network traffic IDS: Intrusion Detection Systems

7. Kittiphan Techakittiroj (25/10/58 12:06 น. 25/10/58 12:06 น. 25/10/58 12:06 น.) Rule-Based Intrusion Detection Rule-based anomaly detection –similar to the statistical approach, but can be a complicated rules Rule-based penetration identification –use expert system to identify the intrusion –based on the known knowledge of attack –Require the update of knowledge IDS: Intrusion Detection Systems

8. Kittiphan Techakittiroj (25/10/58 12:06 น. 25/10/58 12:06 น. 25/10/58 12:06 น.) Reference Books Cyrptography and Network Security by William Stallings (Prentice Hall: 2003)