1 Intrusion Detection “Intrusion detection is the process of identifying and responding to malicious activity targeted at computing and networking resources.”

2 IDS vs. Surveillance Camera Constant vigilance Stealth Design Infrastructure support Adversary belief

3 Basic concepts Monitor Report Respond

4 The Seven Fundamentals 1.What are the methods used 2.How are IDS organized 3.What is an intrusion 4.How do we trace and how do they hide 5.How do we correlate information 6.How can we trap intruders 7.Incident response

5 What are the methods used by IDS? Audit trail processing –Use log file from various processes –Proper collection and consolidations of logs On-the-fly processing –Mostly network based –Looks at raw traffic –Tries to find known “signatures”

6 What are the methods used by IDS? (cont.) Profiles of normal behavior –Estimation of initial behavior –Fine-tuning –Using out-of-band information Signatures of abnormal behavior –Known attacks –Suspicious patterns Parameter pattern matching or anomaly discovery

7 How are IDS organized Architecture CIDF

8 How are IDS organized (cont.) Sensor System Management (custom, SYSlog, SNMP, …etc.) Processing (Analysis) Knowledge Bases Audits and Archives Alarms (Static and Dynamic) User interface (GUI, tail –f, …etc.)

9 What is an Intrusion Intrusion vs. attack “Sequence of actions that maybe interleaved with other unrelated actions”

10 How do we trace and how do they hide In-band techniques –May use cryptography, weaving approaches, compromised systems,..etc Out-of-band techniques –Public access areas: Cyber cafes, telephony techniques,..etc.

11 How do we correlate information Single sessions and multiple session correlation Real time vs. After the fact correlation In-band vs. all-band information

12 How can we trap intruders Real systems Trap systems IDS diverting

13 Incident response Ignore the problem, and hope it goes away Panic Consider the real factors: –Does the incident involve critical assets –Has it occurred before –It is still going on –Has damage occurred –What policies and procedures have been violated –Are traps available for use