ITIS 3200: Network Security (IDS)

Intrusion

Actions aimed at compromising the security of the target (CIA goals of computing/network resources)

Intrusion Detection

The identification through intrusion signatures and report of intrusion activities

Intrusion Prevention

The process of both detecting and managing intrusion activities throughout the network

IDS Components

IDS Manager that compiles data from sensors to determine intrusion.

Site policies: rules and conditions that define probable intrusions

If intrusion is detected, an alarm is sounded.

Masquerader

An attacker who is using identity of legit user to gain access

Misfeasor

Legit user doing actions they are not authorized to do

Clandestine User

User who tries to block/cover-up actions by deleting audit files and syslogs

Port Scans

Info gathering intended to determine open TCP ports on host

DoS Attacks

Network attacks meant to overwhelm host and shut down legit access

Malware Attacks

Replicating malicious software attacks, Trojan Horses, Computer Worms, viruses, etc

ARP Spoofing

An attempt to redirecting IP traffic in a local-area network

DNS Cache Poisoning

Pharming attack that changes host's DNS cache to a falsified domain name or IP address

False Negative

Attack, no alarm

True Negative

No attack, no alarm

True Positive

Attack, alarm

False Positive

No attack, alarm

Base-Rate Fallacy

Effectiveness of IDSs can be misinterpreted due to a statistical misconception. Occurs when the probablity of some conditional event is assessed without considering the 'base rate' of that event.

Six fields to be included in IDS event records:

Subject, Object, Action, Exception-Condition, Resource-Usage, Time-Stamp

Subject

The initiator of an action on the target

Object

The resource being targeted

Action

The operation being performed by subject on object

Exception-Condition

Any error message/exception condition that was raised by the action

Resource-Usage

Quantitative items that were expended by the system performing/responding to action

Time-Stamp

Unique identifier for the moment attack was initiated

Rule-Based IDS

Rules identify actions that match known profiles of intrusions. The rules encode signatures.

Statistical IDS

A profile is built to determine if user/host is acting unusual and thresholds are created

Network-based IDS

Sits at perimeter of a network and performs deep packet inspection

Host-based IDS

Resides on single system to monitor activity

NMAP

Network scanning tool to identify hosts, open services vulnerable to attacks.

Snort

Network-based IDS using a license for its detection rules. Paid via subscription fees. Runs on Linux and BSD.