Intrusion Detection Systems (IDS) Overview

Intrusion Detection Systems (IDS)

• IDS gathers and analyses information from a computer or network
• It acts like a packet sniffer, intercepting packets traveling through various communication mediums and protocols
• Packets are analyzed after capture
• An IDS evaluates suspected intrusions and triggers an alarm
• IDS monitors network and threat activity, detecting viruses, malware, spyware, etc.
• It identifies the source of these threats and restores affected points
• IDS observes unauthenticated and unauthorized use of network programs

How IDS Works

• Monitors network and threat activity
• Detects viruses, malware, spyware, and different forms of viruses
• Locates the source of threats and restores affected points
• Observes unauthorized use of network programs

Intrusion Detection Systems (IDSs)

• Detect violations of configuration and activate an alarm
• Allow administrators to configure systems to notify them of issues via email or pagers
• Systems can be configured to notify external security services about breaches

IDS Terminology

• Alert or alarm: Triggered by suspicious activity
• False attack stimulus: A false alarm
• False negative: Failure to detect a real attack
• False positive: Detecting an event that is not an attack
• Noise: Non-attack related events that trigger an alarm
• Site policy: Rules dictating allowed behavior within a network
• Site policy awareness: Knowledge of a network's acceptable use policies
• True attack stimulus: A real attack
• Confidence value: Assessment of likelihood of an event being an attack
• Alarm filtering: Filtering of false alarms

Why Use an IDS?

• Prevents problematic behaviors by increasing the perceived risk of detection and punishment
• Detects attacks and security violations
• Detects attack preambles
• Documents existing threats to an organization
• Acts as quality control for security design and administration, especially in large and complex enterprises
• Provides useful information about intrusions

Ways to Detect an Intrusion

• Signature recognition (misuse detection): Identifies events that misuse a system
• Anomaly detection: Identifies intrusions based on fixed behavioral characteristics of users and components
• Protocol anomaly detection: Models based on TCP/IP protocols

Types of IDSs

• Network-based IDS (NIDS): Analyzes packets traveling over the network, comparing them with empirical data to find malicious activities
• Host-based IDS (HIDS): Collects and analyzes data originating from a computer hosting a service (e.g., web server). This data can be analyzed locally or sent elsewhere for central analysis.
• Host-based IDS: Examines the data files on the host and alerts the system administrators of any changes

Disadvantages of HIDS

• Difficult to analyze intrusions on multiple computers
• Difficult to maintain in networks with varied operating systems and configurations
• Can be disabled by attackers after compromise

Network Intrusion Indicators

• Repeated probes of available services on a machine
• Connections from unusual locations
• Arbitrary data in log files (possible Denial-of-Service attempts)
• Repeated login attempts from remote hosts

Modifications to System Software and Configuration Files

• Gaps in system accounting
• System crashes or reboots
• Short or incomplete logs
• Missing logs
• Unusual processes
• Unusual graphic displays or text messages

Selecting IDS Approach and Products

• Consider your system environment, security goals, and existing security policy.
• Evaluate organizational requirements and constraints, especially external requirements and resource limitations.

IDS Product Features and Quality

• Scalability of the product for your environment
• Product testing methods.
• Ability to evolve along with your organization.
• Targeted user expertise level.
• Support provisions for the product

IDS Control Strategies

• Centralized: All IDS control functions in a single location
• Fully distributed: All control functions at each IDS component's physical location
• Partially distributed: Combines both centralized and distributed, with agents reporting to a central facility for broader analysis

IDS Deployment Overview

• Consider the location of elements in the IDS for effective use.
• Select the deployment strategy, considering security requirements and minimal impact.
• NIDS and HIDS can be used together to cover various systems and networks.

Deploying Network-Based IDSs

• NIST recommends four locations for NIDS sensors:
  • Behind external firewalls within the network DMZ
  • Outside external firewalls
  • On major network backbones
  • On critical subnets

Deploying Host-Based IDSs

• Proper deployment is painstaking and time-consuming.
• Start deploying HIDS with critical systems first.
• Install until planned coverage is achieved.

Measuring the Effectiveness of IDSs

• Administrators evaluate the number of attacks detected in a known collection of probes.
• Administrators measure the level of use at which IDSs fail.
• IDS vendors provide testing mechanisms to verify expected performance.
• IDS testing can involve recording and retransmitting packets from real viruses or worms, including those with incomplete TCP/IP session connections (missing SYN packets). It also might include testing against vulnerable systems or environments.

Honey Pots, Honey Nets, and Padded Cell Systems

• Honey pots: Decoy systems to lure attackers away from critical systems, encouraging attacks directed at themselves
• Honey nets: Collection of honey pots connected together
• Padded cells: Protected honey pots that cannot be easily compromised, operating in conjunction with traditional IDSs to redirect attackers to a safe zone

Trap and Trace Systems

• Use techniques to detect intrusions and trace them back to their source
• Traps typically include honey pots/padded cells and alarms

Scanning and Analysis Tools

• Collect information attackers might need for successful attacks
• Attack protocols are detailed sequences of steps or processes
• Footprinting involves researching Internet addresses owned or controlled by a target organization

Tools

• Snort
• KFSSensor