Transcript Chapter 1: Introduction - Rose

Intrusion Detection
CSSE 490 Computer Security
Mark Ardis, Rose-Hulman Institute
May 4, 2004
1
Acknowledgements
Many of these slides came from Chris
Clifton and Matt Bishop, author of
Computer Security: Art and Science
2
Intrusion Detection/Response

Characteristics of systems not under attack:
1.
2.
3.

Actions of users/processes conform to statistically
predictable patterns
Actions of users/processes do not include
sequences of commands to subvert security policy
Actions of processes conform to specifications
describing allowable actions
Denning: Systems under attack fail to meet
one or more of these characteristics
3
Intrusion Detection

Idea: Attack can be discovered by one of the above
being violated

Problem: Definitions hard to make precise
 Automated attack tools



Designed to violate security policy
Example: rootkits: sniff passwords and stay hidden
Practical goals of intrusion detection systems:

Detect a wide variety of intrusions (known + unknown)
 Detect in a timely fashion
 Present analysis in a useful manner


Need to monitor many components; proper interfaces needed
Be (sufficiently) accurate

Minimize false positives and false negatives
4
IDS Types:
Anomaly Detection

Compare characteristics of system with expected values


Threshold metric: when statistics deviate from normal by
threshold, sound alarm


report when statistics do not match
E.g., Number of failed logins
Statistical moments: based on mean/standard deviation
of observations


Number of user events in a system
Time periods of user activity
 Resource usage profiles

Markov model: based on state, expected likelihood of
transition to new states

If a low probability event occurs then it is considered
suspicious
5
Anomaly Detection:
How do we determine normal?

Capture average over time
 But

system behavior isn’t always average
Correlated events
 Events

may have dependencies
Machine learning approaches
 Training
data obtained experimentally
 Data should relate to as accurate normal
operation as possible
6
IDS Types:
Misuse Modeling

Does sequence of instructions violate security
policy?
 Problem:

How do we know all violating sequences?
Solution: capture known violating sequences
 Generate
a rule set for an intrusion signature
 But won’t the attacker just do something different?
 Often, no: kiddie scripts, Rootkit, …

Alternate solution: State-transition approach
 Known
“bad” state transition from attack (e.g. use
petri-nets)
 Capture when transition has occurred (user  root)
7
Specification Modeling

Does sequence of instructions violate
system specification?
 What

is the system specification?
Need to formally specify operations of
potentially critical code
 trusted

code
Verify post-conditions met
8
IDS Systems

Anomaly Detection
Intrusion Detection Expert System (IDES) – successor is
NIDES
 Network Security MonitorNSM


Misuse Detection

Intrusion Detection In Our Time- IDIOT (colored Petri-nets)
 USTAT?
 ASAX (Rule-based)

Hybrid

NADIR (Los Alamos)
 Haystack (Air force, adaptive)
 Hyperview (uses neural network)
 Distributed IDS (Haystack + NSM)
9
IDS Architecture
Agent

Similar to Audit system
 Log
events
 Analyze log

Director
Agent
Host 1
Difference:
 happens

Host 1
in real-time
(Distributed) IDS idea:
Notifier
 Agent
generates log
 Director analyzes logs

Host 1
May be adaptive
 Notifier

Agent
decides how to handle result
GrIDS displays attacks in progress
10
Where is the Agent?

Host-based IDS
 watches
events on the host
 Often uses existing audit logs

Network-based IDS
 Packet
sniffing
 Firewall logs
11
IDS Problem

IDS useless unless accurate
 Significant
fraction of intrusions detected
 Significant number of alarms correspond to
intrusions

Goal is
 Reduce

Reports an attack, but no attack underway
 Reduce

false positives
false negatives
An attack occurs but IDS fails to report
12
Intrusion Response

Incident Prevention



Stop attack before it succeeds
Measures to detect attacker
Example: Jailing (also Honeypots)


Make attacker think they are succeeding and confine to an area
Intrusion handling
1.
2.
3.
4.
5.
6.
Preparation for detecting attacks
Identification of an attack
Contain attack
Eradicate attack
Recover to secure state
Follow-up to the attack - Punish attacker
13
Containment

Passive monitoring
 Track
intruder actions
 Eases recovery and punishment

Constraining access
 Downgrade
attacker privileges
 Protect sensitive information
 Why not just pull the plug?
 Example: Honeypots
14
Eradication
Terminate network connection
 Terminate processes
 Block future attacks

 Close
ports
 Disallow specific IP addresses
 Wrappers around attacked applications
15
Follow-Up

Legal action
 Trace

Cut off resources
 Notify

through network
ISP of action
Counterattack
 Is
this a good idea?
16