Computer Network Forensics Lecture 6 – Intrusion Detection © Joe Cleetus Concurrent Engineering Research Center, Lane Dept of Computer Science and Engineering, WVU

Intrusion Detection Methods Tools Practices

Intrusion Detection Network Intrusion Detection is the process of searching network traffic for intrusions and signs of intrusions

Firewalls fail to prevent Intrusion Firewalls are designed to implement an access control policy E.g., a firewall policy might be: HTTP traffic to the Web server is good, while FTP traffic is bad Once a firewall has accepted a connection, it will not check that connection for signs of intrusion

Firewalls fail to prevent Intrusion Network Intrusion Detection Systems (NIDS) look for intrusions on your network and report whenever an intrusion is found Example: Snort at - an open source producthttp://

Snort Overview Many command line options to play with 3 modes of use: sniffer, packet logger, and network intrusion detection system 1.Sniffer: snort -v (show packets) or snort -vd (show packets and headers) 2.Packet Logger: snort -dev -l./log 3.Network Intrusion Detection (NIDS) mode: –snort -dev -l./log -c snort.conf ( snort.conf has the rules database)

Snort - Writing Rules - a simple intro

Preventing Intrusion Method 1: signature-based detection, which compares traffic to signatures of well-known intrusion techniques (like anti-virus software) Method 2: protocol anomaly detection, which compares the actual traffic on the network to the specifications of each protocol (such as HTTP and FTP) and reports anomalies

Detecting Intrusion A "root" login can be detected only with a signature, DNS cache poisoning can be detected only with protocol anomaly detection Hence, implement as many intrusion detection methods as possible

Errors A false-positive happens when an NIDS reports an intrusion in valid traffic Quality of the Signature Database has to do with this Snort, for example, would generate many false- positives, as opposed to some commercial products

Preventing Intrusion To prevent attacks, you need an IDP (intrusion detection and prevention) IDP is deployed in the line of packets and blocks intrusions as they are detected An IDP product can be found at

OneSecure Intrusion Detection and Prevention (IDP) System Accurate Attack Detection –Multiple Methods to detect more attacks –Stateful Signature to reduce false positives Prevention –Drop packets as they are detected Management –Easy rule-based approach

Multiple Methods of Attack Detection Stateful Signature Detection –IDP tracks the state of a connection and looks for attack patterns in only the relevant portions of the traffic Protocol Anomaly Detection –Protocol anomaly detection can be used to identify the attacks that deviate from the protocols that "normal" traffic follows

Multiple Methods of Attack Detection Backdoor Detection –IDP identifies the unique characteristics of the interactive traffic and sends an alarm for unexpected activity Traffic Anomaly Detection –Traffic anomaly detection can identify reconnaissance activity by comparing incoming traffic to "normal" traffic patterns, and identifying deviations

Multiple Methods of Attack Detection Network Honeypot –Network Honeypot sends fake information to people scanning the network to try an entice attackers to access the non-existent services. It identifies the attacker when they attempt to connect to the service

Prevention Drop malicious packets from the network during the detection process to ensure the attack never reaches its target "victim (active response) Avoiding TCP reset or Firewall signal ensures no time is lost and attack does not penetrate - so no investigation is needed (passive response) Avoids DoS attacks