1. Ch.22 INTRUSION DETECTION
이상일

2. Principles
Systems are not under attack exhibit 1. The action conform to a statically predictable pattern 2. The action not subvert the security policy 3. The action conform to specifications describing action

3. Basic Intrusion Detection
Attack tool – Attack tool is an automated script designed to violate a security policy
Attack tools do not change the nature of intrusion detection fundamentally

4. Goal of Intrusion Detection
Detect a wide variety of intrusions.
Detect intrusions in a timely fashion.
Present the ananlysis in a simple, easy to understand format.
Be accurate.

5. Models
Anomaly modeling
Misuse Modeling
Specification Modeling

6. Anomaly modeling Analyze a set of characteristics of the system
Compare their behavior with a set of expected values
Report when the computed statistic do not match the expected measurement

7. Anomaly modeling Thresh hold metric minimum ~ maximum are expected
Statistical moments standard deviation and other measures of correlation
Markov model notion and state

8. Misuse Modeling
Detection determines whether a sequence of instructions being executed is known to violate the site security policy being executed.
If so, it report a potential intrusion

9. Misuse Modeling IDOT system audit log monitoring
STAT system actual state and change them

10. Specification Modeling
Determine whether or not a sequence of instruction violates a specification of how a program, or system, should excute.
If so, it reports a potential intrusion

11. Architecture A,B,C – general purpose computer
N – Network monitoring, Report data to Director

12. Agent
An agent obtains information from a data source (log file, process, network)
Goal : Provide the director with information

13. Agent
Host based information gathering - use system and application logs to obtain record of events, and analyze
Network based information gatering - use a device and software to monitor network traffic
Combining source - to agent can report to the director and director can conclude form analyzing the information

14. Director Eliminate unnecessary and redundant record
Use an analysis engine to determine if an attack is underway
Director use asects of machine learning or planning
Generally, Director uses a several of techinques

15. Notifier Accept information from the director
Take the appropriate action
Intrusion Response

16. Organization of Intrusion Detection Systems
Monitoring Network Traffic for Intrusions: NSM
Combining Host and Network Monitoring : DIDS
Autonomous Agents: AAFID

17. NSM (Network Security Monitor)
Monitoring Network Traffic for Intrusions
Monitoring : source, destination, network traffic
Assign Unique ID to each connection

18. NSM (Network Security Monitor)
Use Matrix allowed simple signiture bases schema go look for misuse
Specific rule
1. NSM served as the basis for a large number of intrusion detection system 2. NSM proved preforming intrusion detection on network was practical

19. DIDS (Ditributed Intrusion Detection Sysmem)
Combining Host and Network Monitoring
DIDS used a centralized analysis engine, and required that agents be placed on the system being monitored
Problem – changing identity as an intruder moves form host to host

20. DIDS (Ditributed Intrusion Detection Sysmem)
Expert system’s Six layer
1. Log records are all visible 2. Abstract relevant information from the Log record 3. Define a subject that capture all events associate with single user 4. Add contextual information 5. Deal with network threat which are combination of events in context 6. assign a score, 1~100, representing the security state of the network

21. AAFID Autonomouse Agent For Intrusion Detection
An Autonomous Agents is a process can act independently of the system of which it is a part
AAFID is in the cooperation of the agents.
Each agent would have its own internal model.

22. AAFID Autonomouse Agent For Intrusion Detection
One agent is compromissed, the others can continue.
Making the agents small and simple
Drawback : Overhead of the communication. An attendant increase overhead. Communication must secured.

23. Intrusion Response
Goal is to handle the attack that demage is minimize
1. Incident Prevention 2. Intrusion Handling

24. Incident Prevention
Ideally, detected and stopped before intrusion succeed
It involves closely monitoring
The attack must be identified before it completes
Multilevel systems are excellent place
Anomaly based method can detect in real time

25. Intrusion Handling Six Phase Preparation for an attack
Identification of an attack
Containment of the attack
Eradication of the attack
Recovery from the attack
Follow up to the attack

26. Containment phase
Two approaches 1. Passively monitoring attack - simply record attacker’s action 2. Constraining access - confinement the data or resources

27. Eradication phase Eradication means stopping attack
Deny access or terminate the process
Wrapper : to place around suspected targets, wrapper can control access
Firewall : The firewall sit between an internal network and other external network, the firewall controls access
IDIP protocol : a protocol for coordinated responses to attack

28. Follow up phase
Counterattacking 1. A legal mechanism 2. A techincal attack
Considering 1. The counterattack may harm an innocent party 2. Counterattack may have side effects 3. Counterattack is antithetical to the shared use of a network 4. The couterattack may be legally actionable