Term paper

cyber security awareness

-Topic-
Network intrusion detection methods

INTRODUCTION

Intrusions are the activities that violate the security policy of the system, and intrusion detection is the process used to identify intrusions. Intrusion Detection Systems look for attack signatures, which are specific patterns that usually indicate malicious or suspicious intent.
Intrusion Detection Systems (IDSs) are usually deployed along with other preventive security mechanisms, such as access control and authentication, as a second line of defense that protects information systems. Intrusion detection provides a way to identify and thus allow responses to, attacks against these systems.
Second, due to the limitations of information security and software engineering practice, computer systems and applications may have design flaws or bugs that could be used by an intruder to attack the systems or applications. As a result, certain preventive mechanisms (e.g., firewalls) may not be as effective as expected. Intrusion detection complements these protective mechanisms to improve the system security. Moreover, even if the preventive security mechanisms can protect information systems successfully, it is still desirable to know what intrusions have happened or are happening, so that we can understand the security threats and risks and thus be better prepared for future attacks.
IDSs may be classified into Host-Based IDSs, Distributed IDSs, and Network-Based IDSs according to the sources of the audit information used by each IDS. 1) Host-based IDSs get audit data from host audit trails and usually aim at detecting attacks against a single host. 2) Distributed IDSs gather audit data from multiple hosts and possibly the network that connects the hosts, aiming at detecting attacks involving multiple hosts. 3) Network-Based IDSs use network traffic as the audit data source, relieving the burden on the hosts that usually provide normal computing services.

GOALS OF NETWORK BASED IDS

1. Real Time Monitoring Of Networks. 2. Forensic Analysis i.e. Provide information about attacks that have succeeded. 3. Passive Systems i.e. Monitoring and Reporting. 4. Active Systems i.e. Corrective Measures Adopted.

VARIOUS TECNIQUES OF INTRUSION DETECTION

a) Anomaly-Based Intrusion Detection System:

An Anomaly-Based Intrusion Detection System, is a system for detecting computer intrusions and misuse by monitoring system activity and classifying it as either normal or anomalous. The classification is based on rules and attempts to detect any type of misuse that falls out of normal system operation. To determine what attack traffic is, the system must be taught to recognize normal system activity. This can be accomplished in several ways, most often with artificial intelligence type techniques. Systems using neural networks have been used to great effect. Another method is to define what normal usage of the system comprises using a strict mathematical model, and flag any deviation from this as an attack. This is known as strict anomaly detection.

Examples of that types of attacks that are suitable for anomaly detection:

i) Denial-of-service (DOS) attacks: Such attacks involve either significantly increased packet traffic or significantly increase connection attempts, in an attempt to overwhelm the target system. Anomaly detection is well suited to such attacks.

ii) Scanning: A scanning attack occurs when an attacker probes a target network or system by sending different kinds of packets. Using the responses received from the target, the attacker can learn many of the system’s characteristics and vulnerabilities. Thus, a scanning attack acts as a target identification tool for an attacker. Scanning can be detected by atypical flow patterns at the application layer (e.g., banner grabbing3), transport layer (e.g., TCP and UDP port scanning), and network layer (e.g., ICMP scanning).

iii) Worms: Worms spreading among hosts can be detected in more than one way. Some worms propagate quickly and use large amounts of bandwidth. Worms can also be detected because they can cause hosts to communicate with each other that typically do not, and they can also cause hosts to use ports that they normally do not use. Many worms also perform scanning.

Limitations: 1. Assumes that intrusions will be accompanied by manifestations that are sufficiently unusual so as to permit detection. 2. These generate many false alarms and hence compromise the effectiveness of the IDS.

b) Signature-Based Intrusion Detection System:

This IDS possess an attacked description that can be matched to sensed attack manifestations. ID system is programmed to interpret a certain series of packets, or a certain piece of data contained in those packets as an attack. For example, an IDS that watches web servers might be programmed to look for the string “XYZ” as an indicator of a program attack. Most signature analysis systems are based off of simple pattern matching algorithms. In most cases, the IDS simply looks for a sub string within a stream of data carried by network packets. When it finds this sub string it identifies those network packets as vehicles of an attack.

Examples of that types of attacks that are suitable for signature detection:

i) Application layer reconnaissance and attacks: Most NIDS technologies analyze several dozen application protocols. Commonly analyzed ones include Dynamic Host Configuration Protocol (DHCP), DNS, Finger, FTP, HTTP, Internet Message Access Protocol (IMAP), Internet Relay Chat (IRC), Network File System (NFS), Post Office Protocol (POP) etc. as well as database protocols, instant messaging applications, and peer-to-peer file sharing software. The NIDS is looking for attack patterns that have been identified as targeting these protocols. Examples of attack include buffer overflows, password guessing, and malware transmission.

ii) Transport layer reconnaissance and attacks: NIDSs analyze TCP and UDP traffic and perhaps other transport layer protocols. Examples of attacks are unusual packet fragmentation, scans for vulnerable ports, and TCP-specific attacks such as SYN floods.

iii) Network layer reconnaissance and attacks: NIDSs typically analyze IPv4, ICMP, and IGMP at this level. Examples of attacks are spoofed IP addresses and illegal IP header values.

iv) Unexpected application services: The NIDS attempts to determine if the activity on a transport connection is consistent with the expected application protocol. An example is a host running an unauthorized application service.

v) Policy violations: Examples include use of inappropriate Web sites and use of forbidden application protocols.

Limitations: 1. They are unable to detect novel attacks. 2. Suffer from false alarms. 3. Have to program again for every new pattern to be detected.

STRENGTHS OF NETWORK BASED IDS

1. Cost Of Ownership Reduced. 2. Packet Analysis. 3. Evidence Removal. 4. Real Time Detection and Response. 5. Malicious Intent Detection. 6. Complement and Verification. 7. Operating System Independence.

----------------------------