 CEG 499/699:
|
|
| 07/27/00 |
As the name implies, the goal of intrusion detection is to be able to identify if and when an intrusion has occurred. Because we must minimize damage done by an intruder and are also interested in catching the intruder, we place a premium on discovering the intrusion as soon as possible -- within seconds, that is. Intrusiondetection is the logical complement to network firewalls, extending the security management capabilities of system administrators to include security audit, monitoring, attack recognition, and response.
Intrusion includes attacks coming from outside the organization as well as misuse originating inside the organization. Intrusion Detection systems collect information from a variety of system and network sources, then analyze the information for signs of intrusion and misuse. Vulnerability assessment performs rigorous examinations of systems in order to locate problems that represent security vulnerabilities.
Integrity protection systems detect when critical components have changed, and assume that the changes must have been due to malicious activity such as when backdoors have been added to system files. Some well known integrity verifiers are:
Extensive system logs must be generated recording all system activity as these logs will contain evidence of an intrusion that can be discovered at least after the fact. Here are the most common of these logs. Be aware that in different Unix variants the location of these files varies.
On systems that must be secure, the standard logs and directories such as /etc and /var/log are not good enough. One must employ additional logging tools. E.g., who is connecting to services on your system? There are many programs under the heading of IP loggers available.
It is important that the log files are not stored on the system that generates the logs. Attackers have been able to edit these. They have also deliberately caused harmless activity that generated so much logging that the disks become full before attempting malicious actions.
But, these logs are often so large that is hard for the average person to analyze and manage. There are programs that can be searched under the phrase "log file analysis" that examine the logs systematically and alert you to suspicious activity.
Traffic sniffers are a double edged sword. They can be used to track the communications of intruders in wonderful detail, but they can also be used to sniff passwords and other sensitive information. You should be very careful in your use of these powerful programs. The machines running these programs should as hardened as possible.
Specific signatures or patterns characterize attack attempts. Semantic descriptions or signatures of known attacks are collected or formulated and stored in a database. One type of signature analysis, audit trail analysis, compares information found in the audit trails, e.g., a system's builtin audit log or event log, with the attack signatures. Attack scenarios might be translated into sequences of audit events, or into patterns of data that can be sought in the audit trail generated by the operating system of a computer, by router software, firewalls, switches, or applications. Other patterns or sequences may be found in a stream of network traffic. When a sequence of events is found in the audit trail, or in the network traffic, that matches a sequence of audit events, or the signature of an attack, an attempt of an intrusion is suspected.
The main drawback of the signature analysis technique -- like all misusebased approaches -- is the need for frequent updates to keep up with the stream of new vulnerabilities/attacks discovered, this situation is aggravated by the requirement to represent all possible facets of the attacks as signatures in a signature database.
There are two major approaches to rule-based intrusion detection:
Rulebased description languages form natural tools for modeling the knowledge that experts have collected about attacks. This approach allows a systematic browsing of the audit trail in search of evidence of attempts to exploit known vulnerabilities. They are also used for verifying the proper application of the security policy of an organization. The main limitations of this approach are 1) the difficulty of extracting knowledge about attacks and 2) the processing speed.
This technique describes an attack with a set of goals and transitions, but
represents them as statetransition diagrams. States in the attack pattern,
corresponding to system states, have Boolean assertions associated with them
that must be satisfied to transition to that state. This approach is
conceptually identical to modelbased reasoning.
SBID assumes that intrusions can be detected by inspecting a system's audit trail data for unusual activity, and that an intruder's behavior will be noticeably different from that of a legitimate user. Before unusual activity can be detected, SBID systems require a characterization of user or system activity that is considered "normal." These characterizations, called profiles, are typically represented by sequences of events that may be found in the system's audit data. Any sequence of system events deviating from the expected profile by a statistically significant amount is flagged as an intrusion attempt. The main advantage of SBID systems is that intrusions can be detected without a priori information about the security flaws of a system.
SBID systems typically employ statistical anomaly and rule-based misuse models. System profiles, user profiles, or both may be used to define expected behavior. User profiles, if used, are specific to each user and are dynamically maintained. As a user's behavior changes over time, so too will his user profile. No such profiles are used in RBID systems. As is the case with RBID systems, known intrusion scenarios can be codified into the rule base of SBID systems.
Detection of specific denialofservice attacks that make use of weaknesses in the Internet protocol suite can be subsumed under the statistical approach. One example is the SYN flood attack where an attacker sends many connection requests with a forged source IP address and requires the attacked system to acknowledge these requests without finally receiving a confirmation. Though the attacker seems to behave according to the communications protocol, the attack can only be detected by the quantity of connection requests received within a certain period of time. The quantity of requests together with the configured number of allowed open connections define the threshold for this type of attack.
Neural networks are algorithms that learn about the relationship between
inputoutput vectors and ''generalize'' them to obtain new inputoutput
vectors in a reasonable way. The main use of neural networks for intrusion
detection is to learn the behavior of actors in the system (e.g., users,
daemons). The advantage of using neural networks over statistics resides in
having a simple way to express nonlinear relationships between variables, and in
learning/retraining the neural network automatically. Neural networks are still
a computationally intensive technique, and are not widely used in the intrusion
detection community.
This technique models the normal or authorized behavior of users by the set
of tasks they have to or are authorized to perform on the system. These tasks
and facets of the system's security policy are then represented as patterns for
users' expected or authorized actions such as access to particular files or
types of files. These actions are related to the audited or logged events, e.g.
security related events, which are observed and recorded by the system. The
analyzer keeps a set of tasks or patterns that each user should or may perform.
Then by comparing, either realtime or offline, the individuals' actions
found in the audit trails with their desired or authorized patterns and they do
not fit the task pattern an alarm is issued. This method is similar to signature
analysis except that the inspection expects the actions to match the pattern for
proper activity and when it fails to match it signals suspected improper
activity, while in signature analysis the inspection expects the activity to not
match the pattern (signature) for improper activity and when it matches an
attempt at intrusion is suspected.
LIDS (http://www.lids.org/) an intrusion detection/defense system in Linux kernel. It modifies the Linux kernel sources which enhances the kernel's security. When it is in effect, chosen files access, all system/network administration operations, any capability use, raw device, mem, and I/O access can be made impossible even for root.
Deception systems provide attractive targets for attackers, making it easier to catch them. The site referenced below is a required visit and required reading even if you do not play with the software.
None.
| 07/27/00 02:05:17 PM |
| Copyright © 2000 pmateti@cs.wright.edu |