1 Intrusion Detection Methods “Intrusion detection is the process of identifying and responding to malicious activity targeted at computing and networking resources.”

2 The Seven Fundamentals 1.What are the methods used 2.How are IDS Organized 3.What is an intrusion 4.How do we trace and how do they hide 5.How do we correlate information 6.How can we trap intruders 7.Incident response

3 The Major components of IDS Target System Feed Processing Knowledge base Storage Alarms Operator interface Communications infrastructure Multiple IDS Network management

4 Text book: figure 3-1

5 Major components of IDS (cont.) Target System –Important networks and systems! Feed –Information collected from the target systems and sent back for processing –Q: should feeds carry raw traffic back to the processing system? Should they carry alarms? What are the considerations?

6 Major components of IDS (cont.) Processing –The execution of the detection algorithms Knowledge Base –Used to store information about attacks, user profiles,..etc. –Ability to update is an important issue Storage –Short term vs. long term storage –Performance and capacity issues

7 Major components of IDS (cont.) Alarms and Directives –Various types of configurable alarms and notification methods are typically supported –Increasing trend towards using them for automatic reconfiguration of other network components (See CIDF for messaging model) Communications infrastructure –Used for communications between IDS components –Security needs?

8 Major components of IDS (cont.) Multiple IDS –Common in many environments –The need for secure integration Network management –Integration and interaction issues

9 IDS processing Processing components in IDS include: –Engines Filters Set of autonomous agents each performing a specified task –Management –Correlation Combine results! Interface with other components

10 IDS algorithms Baseline processing while (true) { target_system_feed(info); intrusion_processing(info, results); If (result == intrusion) initiate_response(result); }

11 IDS algorithms (cont.) Dynamic association while (true){ target_system_feed(info); if (suspicious(info) && new(info)) create new association if(suspicious(info)&& not new(info)) add to existing association }

12 IDS algorithms (cont.) Audit trail data reduction –Loop over log records Consider combinations of records Check if they are relevant to current incident –Append to report Other types of data reduction?

13 IDS algorithms (cont.) Out-of-band correlation processing while (true){ target_system_feed(info); if (OOB_data) get_OOB(operator_input); if(relevant(info, operator_input) combine(info, operator_input); }

14 IDS algorithms (cont.) Attack filter pattern matching while (true){ target_system_feed(info); For (i=0; i< NumFilters; i++) if (match(filter[i], info)) AttackFound(i) }

15 IDS Knowledge Base Profiles of normal and abnormal behavior Attack signatures Suspicious traffic patterns / strings Information used to initiate responses and actions

16 IDS Feed Processing System Management Storage Alarms/ Directives GUI/ Operator Interface Target System Knowledge Bases attack signatures other static info response actions user profiles system profiles

17 IDS Storage Archives IDS logs Dynamic buffer The case of Oklahoma bank Camera The case of the Cuckoo's Egg

18 IDS Feed Processing System Management Knowledge Base Alams/ Directives GUI/ Operator Interface Target System Intrusion Detection Storage audit log bufferarchive

19 CIDF Architectural conventions Message specifications (GIDO: generalized ID objects) Transmission standards for sending GIDOs between components Communications protocol for CIDF components API for CIDF

20 CIDF Event generator (E-Box) Analysis Engine (A-box) Storage (D-Box) Response component (R-Box)