-------------------------------------------------
IMPROVING INTRUSION PREVENTION (IPS)SENSOR SYSTEM

University of Maryland University College By Isaac Chellepo Toee
-------------------------------------------------
IMPROVING INTRUSION PREVENTION (IPS)SENSOR SYSTEM

University of Maryland University College By Isaac Chellepo Toee
To: Professor Jim Chen
To: Professor Jim Chen

Table Content
2………………………………………………………………………Abstract
3……………………………………………………………………….Introduction
4………………………………………………………………………Scope
4-5……………………………………………………………………Importance of IPS
5-6……………………………………………………………………IPS Challenges
7………………………………………………………………………IPS Sensor
8………………………………………………………………………Limitations and Benefits
8-9……………………………………………………………………Solution
10………………………………………………………………….…Conclusion
11…………………………………………………………………….References

ABSTRACT

This paper illustrate an Intrusion Prevention System (IPS) which is based on sensors in the
Network. These sensors are considered honeypots. The system is designed to offer a lot of possibilities to get the most of information gathered about attackers. The analysis of network based intrusion prevention system process reveals one challenge facing administrator: containing the threats or mitigating the threats in the shortest possible time. Information security is crucial and plays a very important role in designing any high-speed network device on system. Since the present generation of intrusion prevention system has numerous limitations on performance and effectiveness, there should be an alternate solution. In this paper, I will discuss the analysis of the intrusion prevention system sensor process and the challenges administrators face in dealing with threats. This paper will also discuss ways to contain attacks by sensors that have the capability to divert attacks and avoiding false-positive.

INTRODUCTION
Sensor in Intrusion Prevention System is an important Information Technology tools for administrator. The continuously increased size and the complexity of the internet and intranet networks have led to increasing the number of vulnerabilities that could be exploited. The attackers are always finding the smartest ways to bypass the security controls and to compromise the security of a well-functioning system. Sensor in Intrusion Prevention Systems (IPS) is an important tool to detect possible incidents and also, attempt to stop them in real time. Intrusion Prevention is the process of monitoring the information systems by sensors and analyzing the collected information to detect, log and to attempt to stop the attacks in real time, identifying vulnerabilities, the violation of security policies or standard security practices. Additionally, Intrusion Prevention Systems (IPSs) can take some actions to attempt to stop the attack, such as breaking the connection or diverting and using honey pot to deny access to the intruder.
.
Purpose
This intrusion prevention system project describes network base computer system vulnerabilities along with its associated threats. The purpose of this project is to provide individual/corporate network with the technical security control through sensor that are currently in place and to modify and ensure the proper protection to the network. This report will identify limitations and advantages that maybe present due to the proper implementation of IPS on a computer network.

Scope
The scope of this Intrusion Prevention System is to evaluate the protection of a network base computer system in real time and in the area of technical controls. The project is limited to IPS sensor security, and how it might enhance security and reduce cost. The process in the project will involve visit to the library and research and self-ingenuity
Method
This project is based on sensor on Intrusion Prevention System approach. The IPS will focus on traffic to a computer network. The baseline approach would give me the general security control on the larger entity. Although there are other IPS tools in use, the approach is to help virtualize way to stopping, diverting, dropping or mitigating attacks by means of IPS sensor tools to reduce time and cost on system and management as whole.
Importance of IPS
Intrusion Prevention is considered the act of not only dropping deleted bad traffic in real-time but also not allowing such traffic to pass through and continue to its destination. Hence, Intrusion Prevention is useful to combat against such malicious attacks as denial of services, brute force attacks, vulnerability detection etc. There are three approaches to achieve intrusion prevention: building systems with no vulnerability (at least to 98.99% since the system cannot be 100% because of many factors), taking remediation steps to uncover threats and vulnerabilities, and detecting any attempts and blocking them before serious damage is done.
One effective way of using IPS sensor is its placement in the network. IPS operates on the In-line mode; therefore, the sensor is placed (should be placed) directly in the network traffic path so that all traffic that passes through the ports are inspected. Research had shown that In-line mode enables the sensor to run in either protective or protection mode [1]. This is an efficient way of dealing with packets inspection since the inspection is performed in real time and the intrusive packets are dealt with immediately .This is possible because the sensor is placed on the network and is physically in the path of the all network traffic. Also, since IPS usually sits in line with network traffic, it can shut down attacks, block access to the target or block access from the attacker and may even be able to talk to firewall to block an attack.

IPS Challenges
Intrusion preventive system sensor holds great future for small and big businesses in the market. Even though IPS does not mitigate fault, one of its major problem is false-positive-- when legitimate traffic is misidentified as malicious. False positive becomes very horrible when an exploit signature rule is not configured carefully enough, such that legitimate traffic can cause it to alarm accidentally. In a preventive system, false-positive can terribly interrupt, block or divert legitimate and valid business transactions. Also, IPS sensor has the potential to act as a bottleneck even if the devices do not fail together because it has to keep up with huge network traffic. The dropping of packets are some issues IPS. Because some of these dropped packets are or may be used to exploit data stream.
Additionally, Walder (2003) said it is problematic for administrators to perfectly describe the flow of traffic on network with a huge degree of accuracy. The problem with any gigabit IPS/IDS product is, by its very nature, the amount of alert data it is likely to generate. On a busy network, how many alerts will be generated in one working day? Or even in one hour?
Unless a device is placed in-line, sometimes it is extremely difficult to perform any kind of guaranteed prevention unless IPS sensor is placed in-line and in most cases, sending TCP resets or reconfiguring firewalls are ineffective prevention mechanisms. Because by the time the response has been completed, the payload shall have been delivered already.
IPS sensor, like any other protective tool, has its drawbacks. The deployment, implementation and maintenance like deploying and troubleshooting updates are what administrators need to deal with. But the most important of IPS sensor challenge is false-positives. IPS has a less potential of keeping false-positive minimum. The rate of false-position is so frustrating that administrators tend to pay death ear to some alerts and defeating it purpose.
Other limitation of IPS working in Inline mode are: an IPs sensor must be inline, sensor error failure can have a negative effect on network traffic, huge traffic do have an outward effect on IPS sensor, user deploying IPS sensor much have good operational understanding of the deployment, and IPS sensor affects network timing because of latency. [8]

IPS Sensor
Start
Start

Sensor activate

Sensor activate

Sensor alarm

Sensor alarm

NO
NO

Figure 1 displaces a flow chart that depicts an IPS sensor with false-positive alarm. The system should be capable to investigate and the fault and elevate or mitigate it while the system maintains full operation.
Figure 1 displaces a flow chart that depicts an IPS sensor with false-positive alarm. The system should be capable to investigate and the fault and elevate or mitigate it while the system maintains full operation.

Yes
Yes

Any Fault ?

Any Fault ?

NO
NO

False positive?
False positive?
Yes
Yes

Redirect fault
Redirect fault

Honey pot
Honey pot
Yes
Yes Re-dir. /Invest.
Re-dir. /Invest.

Trouble shoot
Trouble shoot
Sensitivity
Sensitivity

Is Sensor good ?
Is Sensor good ?
Yes
Yes

Signature ?
Signature ?

Stop
Stop
NO
NO

Replace sensor
Replace sensor

Fig. 1
Figure 1 displaces a flow chart that depicts an IPS sensor with false-positive alarm. The sensor should be able to isolate false-positive fault. At the start process, sensor is installed and activated. When there is an alarm, sensor redirects attacker/fault to honey-pot to avoid system short down. Once the attacks had been diverted, the system is trouble shoot to elevate the problem.
On the other hand, if the fault is false-positive, the system is capable of redirecting attacker/fault to a honey pot while maintaining full functionality. The sensitivity of the sensor and mechanism are checked and signature rule configured is examined; and if signature rule proved to be incredible, the signature rule is properly reconfigured and/ or sensor is replaced.
Advantages and limitations of deploying an IPS in Inline mode Advantage | Limitation | IPS sensor can be configured to perform a packet drop that can stop the trigger packet, packets in connection or packets from a source IP address | IPS sensor much be inline and its error and failure can have a negative effect on network traffic | When IPS sensor is inline, it can use stream normalization techniques to reduce huge network evasion capabilities that exist | Too much traffic does have an effect on IPS sensor | Working in inline mode gives more security to the users on which the IPS is running | User deploying IPS sensor much have good operational understanding of the deployment | | IPS sensor affects network timing because of latency. |

Cost-Benefits Analysis
This process of diverting fault to honey pot will avoid shorting down of the system when there is not a fault in the system and also avoid shorting the system down when there is false-positive. This process will enhance productivity, continuity, and integrity of the company, business or the individual system. System administers will also be worry free from frustration of dealing with false-positive which is very annoying. The resources and cost will also dramatically reduce.
Solution
How do we prevent or mitigate fault/attacks from happening? The creation of sensor in the IPS system that is capable to separate false positive from legitimate attacks is worth the challenge. The sensitivity of the sensor should be capable to investigate attacks and separate legitimate attacks and also be able to examine signature-rule against deployed signature. Also, an alternative solution is the vigorous use of honey pot on IPS sensor on regular bases on the workstations, application and vulnerability patches. There is a cost factor. The physical security, maintenance and updates are considerations that management needs to take into account. As new technology comes in place and sensors and IPS continue to improved, training of staffs is necessary not only to manage the system but to understand, analyze and interprets the alert when it triggered a problem. Architecture that uses sensors together with IPS technologies as described in figure one (1) in this paper should prove to be a better solution for defense in depth.

CONCLUSION
Sensor deployed in IPS device should be capable to investigate attacks and be able to separate legitimate attacks; and also be able to examine signature-rule against proper signature-rule configuration deployed in the system. Additionally, in this changing and complex environment there are several factors/variables that influence the performance. Good knowledge of methods and technologies incorporated into every product leads to a good choice of products implemented since each product has its own detection capabilities and every computer system has specific threats and vulnerabilities. Hence, to effectively deploy sensors on IPS, there is a need to have a perfect understanding of the environment in question and where the sensor on IPS is to be deployed. Any architecture that uses sensors as described in figure one (1) together with IPS technologies should prove to be a better solution for defense in depth.

References [1] Ahdi, F., Wang, W., Srinivasan, V., & Chua, K. (2010). IPS-MAC: an informative preamble sampling MAC protocol for wireless sensor networks. Wireless Networks (10220038), 16(5), 1373-1387. doi:10.1007/s11276-009-0209-7 [2] Bendriss, E., & Regragui, B. (2013). Honeypot Based intrusion Management system: From a passive architecture to an IPS system. Journal of Theoretical & Applied Information Technology, 47(2), 792-797.
[3] Lerner, P., (2012). Tips for implementing IP S Security. Retrieved from http://www.networkworld.com/news/tech/2012/112612-ips-264523.html [4] Palumbo, F., Ullberg, J., Štimec, A., Furfari, F., Karlsson, L., & Coradeschi, S. (2014). Sensor network infrastructure for a home care monitoring system. Sensors (14248220), 14(3), 3833-3860. doi:10.3390/s140303833 [5] Ping, Y., Ting, Z., Jianquing, M., & Yue, W. (2013). An Intrusion prevention mechanism in mobile Ad Hoc networks. Adhoc & Sensor Wireless Networks, 17(3/4), 269-292. [6] Rassam, M. A., Maarof, M. A., & Zainal, A. (2012). A Survey of Intrusion Detection Schemes in Wireless Sensor Networks. American Journal Of Applied Sciences, 9(10), 1636-1652. [7] Stanciu, N. (2013). Technologies, methodologies and challenges in network intrusion detection and prevention systems. Informatica Economica, 17(1), 144-156. doi:10.12948/issn14531305/17.1.2013.12
[8] Suchita, P., Rane, P., Kulkarni, P., & Meshram, B., (n.d). IDS vs IPS. Retrieved from http://www.ijcnwc.org/papers/vol2no12012/16vol2no1.pdf
[9] Thi-Tham, N., Duc Van, L., & Seokhoon, Y. (2014). Maximization of the Supportable Number of Sensors in QoS-Aware Cluster-Based Underwater Acoustic Sensor Networks. Sensors (14248220), 14(3), 4689-4711. doi:10.3390/s140304689
[10] Walder, B. (2003). Is intrusion prevention better than cure?. Computer Weekly, 46.