1. Intrusion Detection Systems

2. Overview of Topics Discussed in Text
Security threat analysis
Design and Implementation
Architecture
Encryption
Strong Authentication
Access Controls (such as Firewalls)
Alarms and alerts (such as IDS)
Honeypots
Traffic flow security
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

3. CSCE 522 - Eastman/Farkas - Fall 2005
Intrusion Control
Prevent unauthorized users from accessing system
Prevent damage from unauthorized users
Repair damage from unauthorized users
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

4. CSCE 522 - Eastman/Farkas - Fall 2005
Need:
Intrusion Prevention: protect system resources
Intrusion Detection: (second line of defense) discriminate intrusion attempts from normal system usage
Intrusion Recovery: cost effective recovery models
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

5. It is better to prevent something than to plan for loss.
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

6. CSCE 522 - Eastman/Farkas - Fall 2005
Misuse Prevention
Prevention techniques: first line of defense
Secure local and network resources
Techniques: cryptography, identification, authentication, authorization, access control, security filters, etc.
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

7. CSCE 522 - Eastman/Farkas - Fall 2005
Problem: Losses occur!
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

8. Contributing Factors for Misuse
Many security flaws in systems
Secure systems are expensive
Secure systems are not user-friendly
“Secure systems” still have flaws
Insider Threat
Hackers’ skills and tools improve
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

9. Why Intrusion Detection?
Second line of defense
Deter intruders
Catch intruders
Prevent threats from occuring (real-time IDS)
Improve prevention/detection techniques
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

10. Intrusion Detection Milestones
1980: Deviation from historical system usage (Anderson)
1987: framework for general-purpose intrusion detection system (Denning)
1988: intrusion detection research splits
Attack signatures based detection (MIDAS)
Anomaly detection based detection (IDES)
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

11. Intrusion Detection Milestones
Early 1990s: Commercial installations
IDES, NIDES (SRI)
Haystack, Stalker (Haystack Laboratory Inc.)
Distributed Intrusion Detection System (Air Force)
Late 1990s - today:
Integration of audit sources
Network based intrusion detection
Hybrid models
Immune system based IDS
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

12. CSCE 522 - Eastman/Farkas - Fall 2005
Terminology
Audit: activity of looking at user/system behavior, its effects, or the collected data
Profiling: looking at users or systems to determine what they usually do
Anomaly: abnormal behavior
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

13. CSCE 522 - Eastman/Farkas - Fall 2005
More Terminology
Misuse: activity that violates the security policy
Outsider: someone without access right to the system
Insider: someone with access right to the system
Intrusion: misuse by outsiders and insiders
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

14. CSCE 522 - Eastman/Farkas - Fall 2005
Phases of Intrusion
Intelligence gathering: attacker observes the system to determine vulnerabilities
Planning: attacker decide what resource to attack (usually least defended component)
Attack: attacker carries out the plan
Hiding: attacker covers tracks of attack
Future attacks: attacker installs backdoors for future entry points
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

15. Real-time Intrusion Detection
Advantages:
May detect intrusions in early stages
May limit damage
Disadvantages:
May slow down system performance
Trade off between speed of processing and accuracy
Hard to detect partial attacks
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

16. CSCE 522 - Eastman/Farkas - Fall 2005
Off-line Intrusion Detection
Advantages:
Able to analyze large amount of data
Higher accuracy than real-time ID
Disadvantages:
Mostly detect intrusions after they occurred
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

17. CSCE 522 - Eastman/Farkas - Fall 2005
Audit Data
Format, granularity and completeness depend on the collecting tool
Examples
System tools collect data (login, mail)
Additional collection at low system level
“Sniffers” as network probes
Application auditing
Needed for
Establishing guilt of attackers
Detecting subversive user activity
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

18. Audit-Based Intrusion Detection
Profiles,
Rules, etc.
Audit Data
Intrusion Detection
System
Need:
Audit data
Ability to characterize
behavior
Decision
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

19. CSCE 522 - Eastman/Farkas - Fall 2005
Anomaly versus Misuse
Non-intrusive use
Intrusive use
False negative
Non-anomalous but
Intrusive activities
Looks like
NORMAL behavior
Does NOT look
Like NORMAL behavior
False positive
Non-intrusive but
Anomalous activities
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

20. CSCE 522 - Eastman/Farkas - Fall 2005
False Positives
False positive: non-intrusive but anomalous activity
Security policy is not violated
Cause unnecessary interruption
May cause users to become unsatisfied
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

21. CSCE 522 - Eastman/Farkas - Fall 2005
False Negatives
False negative: non-anomalous but intrusive activity
Security policy is violated
Undetected intrusion
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

22. Intrusion Detection Techniques
Anomaly Detection
Misuse Detection
Hybrid Misuse/Anomaly Detection
Immune System Based IDS
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

23. CSCE 522 - Eastman/Farkas - Fall 2005
Rules and Profiles
How do you know what is anomalous?
First define what is normal.
Statistical techniques
Rule-based techniques
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

24. CSCE 522 - Eastman/Farkas - Fall 2005
Two Kinds of Detection
Anomaly-based: standards for normal behavior. Warning when deviation is detected
Misuse-based: standards for misuse. Warning when phases of an identified attack are detected
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

25. Statistical Techniques
Collect usage data to statistically analyze data
Good for both anomaly-based and misuse-based detection:
Threshold detection
E.g., number of failed logins, number of accesses to resources, size of downloaded files, etc.
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

26. Rule-based Techniques
Define rules to describe normal behavior or known attacks
Good for both anomaly-based and misuse-based detection
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

27. CSCE 522 - Eastman/Farkas - Fall 2005
Anomaly Detection
Assume that all intrusive activities are necessarily anomalous  flag all system states that very from a “normal activity profile” .
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

28. Anomaly Detection Techniques
Selection of features to monitor
Good threshold levels to prevent false-positives and false-negatives
Efficient method for keeping track and updating system profile metrics
Update Profile
Deviation
Attack
State
Audit Data
System Profile
Generate New Profile
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

29. Misuse Detection Techniques
Represent attacks in the form of pattern or a signature (variations of same attack can be detected)
Problem!
Cannot represent new attacks
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

30. Misuse Detection Techniques
Expert Systems
Model Base Reasoning
State Transition Analysis
Neural Networks
Modify Rules
Attack
State
Rule
Match
Audit Data
System Profile
Add New Rules
Timing
Information
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

31. CSCE 522 - Eastman/Farkas - Fall 2005
Hybrid Detection
Anomaly and misuse detection approaches together
Example:
Browsing using “nuclear” is not misuse but might be anomalous
Administrator accessing sensitive files is not anomalous but might be misuse
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

32. CSCE 522 - Eastman/Farkas - Fall 2005
Immune System Based ID
Detect intrusions by identifying suspicious changes in system-wide activities.
System health factors:
Performance
Use of system resources
Need to identify system-wide measurements
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

33. Immune System IDS Features
Principal features of human immune system that are relevant to construct robust computer systems:
Multi-layered protection
Distributed detection
Diversity of detection
Inexact matching ability
Detection of previously unseen attacks
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

34. CSCE 522 - Eastman/Farkas - Fall 2005
Intrusion Types
Doorknob rattling
Masquerade attacks
Diversionary attack
Coordinated attacks
Chaining
Loop-back
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

35. CSCE 522 - Eastman/Farkas - Fall 2005
Doorknob Rattling
Attack on activity that can be audited by the system (e.g., password guessing)
Number of attempts is lower than threshold
Attacks continue until
All targets are covered or
Access is gained
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

36. CSCE 522 - Eastman/Farkas - Fall 2005
Masquerading
Target 2
Target 1
Change identity:
I’m Y
Login as Y
Login as X Y
Legitimate user
Attacker
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

37. Diversionary Attack Create diversion to draw TARGET
attention away from
real target
TARGET
Real attack
Fake attacks
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

38. CSCE 522 - Eastman/Farkas - Fall 2005
Coordinated attacks
Target
Attacker
Compromise system
to attack target
Multiple attack sources,
maybe over extended period
of time
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

39. CSCE 522 - Eastman/Farkas - Fall 2005
Chaining
Move from place to place
To hide origin and make
tracing more difficult
Attacker
Target
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005

40. CSCE 522 - Eastman/Farkas - Fall 2005
Intrusion Recovery
Actions to avoid further loss from intrusion.
Terminate intrusion and protect against reoccurrence.
Reconstructive methods based on:
Time period of intrusion
Changes made by legitimate users during the effected period
Regular backups, audit trail based detection of effected components, semantic based recovery, minimal roll-back for recovery.
Intrusion Detection Systems
CSCE Eastman/Farkas - Fall 2005