Intrusion Detection Systems. Tecniche di Sicurezza dei Sistemi2 Intrusion Detection Systems...
-
Upload
margaret-catlow -
Category
Documents
-
view
214 -
download
0
Transcript of Intrusion Detection Systems. Tecniche di Sicurezza dei Sistemi2 Intrusion Detection Systems...
Tecniche di Sicurezza dei Sistemi 2
Intrusion Detection Systems
• Presently there is much interest in systems, which can detect intrusions, IDS (Intrusion Detection System).
• IDS are of very different character. • Some focus on one machine and try to stop the
intruder from doing damage, such is LIDS for Linux.
• Some can detect a worm attack from the way it spreads from machine to machine, like GrIDS.
Tecniche di Sicurezza dei Sistemi 3
Intrusion Detection Systems
• Several are actually data mining, they determine from logfiles if there is an intrusion based on reasoning by an expert system, NSTAT is an example.
• Many IDS implementations are listening passively to some LAN segment, look at the traffic and detect an intrusion. Snort IDS is a popular freeware program of this Network IDS-type.
• Other IDS solutions protect one machine by access controls.
Tecniche di Sicurezza dei Sistemi 4
What is Intrusion Detection
• Intrusion detection systems (IDSs) are designed for detecting, blocking and reporting unauthorized
activity in computer networks.
• “The life expectancy of a default installation of Linux Red Hat 6.2 server is estimated to be less than 72 hours.”
• “The fastest compromise happened in 15 minutes (including scanning, probing and attacking)”
• “Netbios scans affecting Windows computers were executed with the average of 17 per day”
(source: Honeynet Project)
Tecniche di Sicurezza dei Sistemi 5
Unauthorized Use of Computer Systems Within Last 12 Months (source CSI/FBI Study)
0
10
20
30
40
50
60
70
80
Yes No Don't Know
Percentage of Respondents
1996
1997
1998
1999
2000
2001
2002
1.1. Motivation for Intrusion DetectionMotivation for Intrusion Detection
Tecniche di Sicurezza dei Sistemi 6
In year 2002 most common attacks were:
• Virus (78%)
• Insider Abuse of Net Access (78%)
• Laptop theft (55%)
• Denial of Service and System Penetration (40%)
• Unauthorized Access by Insiders (38%)
Most Common Attacks (source CSI/FBI)
1.1. Motivation for Intrusion DetectionMotivation for Intrusion Detection
(Red color shows the attack types, which IDS can decrease)
Tecniche di Sicurezza dei Sistemi 7
Definitions• Intrusion
– A set of actions aimed to compromise the security goals, namely
• Integrity, confidentiality, or availability, of a computing and networking resource
• Intrusion detection– The process of identifying and responding to
intrusion activities
Tecniche di Sicurezza dei Sistemi 8
Prevent
Why Is Intrusion Detection Necessary?
Detect React/Survive
Security principles: layered mechanisms
Tecniche di Sicurezza dei Sistemi 9
Elements of Intrusion Detection• Primary assumptions:
– System activities are observable – Normal and intrusive activities have distinct
evidence
• Components of intrusion detection systems:– From an algorithmic perspective:
• Features - capture intrusion evidences• Models - piece evidences together
– From a system architecture perspective:• Audit data processor, knowledge base, decision
engine, alarm generation and responses
Tecniche di Sicurezza dei Sistemi 10
Components of Intrusion Detection System
Audit Data Preprocessor
Audit Records
Activity Data
Detection Models
Detection Engine
Alarms
Decision Table
Decision EngineAction/Report
system activities are system activities are observableobservable
normal and intrusive normal and intrusive activities have distinct activities have distinct
evidenceevidence
Tecniche di Sicurezza dei Sistemi 11
Different Types of IDSsDifferent Types of IDSs
1. Application based;
2. Host based;
3. Network based.
Tecniche di Sicurezza dei Sistemi 12
Application IDS– Watch application logs– Watch user actions– Stop attacks targeted against an application
Different Types of IDSsDifferent Types of IDSs
•AdvantagesEncrypted data can be read
•ProblemsPositioned too high in the attack chain (the attacks reach the application)
Tecniche di Sicurezza dei Sistemi 13
Host IDS– Watch kernel operations
– Watch network interface
– Stop illegal system operations
– Drop attack packets at network driver
Different Types of IDSsDifferent Types of IDSs
•AdvantagesEncrypted data can be readEach host contributes to the detection process
•ProblemsPositioned too high in the attack chain (the attacks reach the network driver)
Tecniche di Sicurezza dei Sistemi 14
Network IDS– Watch network traffic– Watch active services and servers– Report and possibly stop network level attacks
Different Types of IDSsDifferent Types of IDSs
•AdvantagesAttacks can be stopped early enough (before they reach the hosts or applications)Attack information from different subnets can be correlated
•ProblemsEncrypted data cannot be readAnnoyances to normal traffic if for some reason normal traffic is dropped
Tecniche di Sicurezza dei Sistemi 15
2. Different Types of IDSs2. Different Types of IDSs
Application-, Host- and Network IDS – Comparison
Application-based Host-based Network-basedTechnique Application monitoring Host system monitoring Network segment monitoringData Rate Low Moderate HighPlacement Application, userland process Kernel, system process Network nodeCost ($) Low to Moderate Moderate HighMaintenance Effort Moderate Moderate to High LowEncrypted Data Supported Supported UnsupportedSwitched Networks Not problematic Not problematic Problematic
Tecniche di Sicurezza dei Sistemi 16
Diagram
Simple Process Model for IDSimple Process Model for ID
Capture Data Analyse Data Respond
IterateFor example applications log
network driver, or network cable
Parse data, filter data and execute
Detection Algorithms
Drop packets, send alerts,
update routing tables,
kill processes etc.
Tecniche di Sicurezza dei Sistemi 17
Misuse Detection
IDS principle of detectionIDS principle of detection
Alert tcp !192.168.1.0/24 any -> 192.168.1.0/24 111
(Content: “|00 01 86 A5|”;msg:”External Mountd access”;)
– Search attack signatures, which are patterns, byte code or expressions belonging to a specific attack.– often called signature-based detection– A signature is created by analysing an attack method– The patterns are stored inside the IDS
Example Rule:Example Rule:
There are two basic methods used by ID Systems: misuse detection and anomaly detection.
Tecniche di Sicurezza dei Sistemi 18
Example of a NIDS, snort
• Enable NIDS mode of Snort
# ./snort -dev -l ./log -h 192.168.1.0/24 -
c snort.conf • The above command means that let Snort work as NIDS
for the network 192.168.1.0/24 according to the rules inside snort.conf file.
• Sample rule:• alert udp any any -> 192.168.1.0/24 5060 (content:"|01 6a 42 c8|"; msg: “SIP session signaling";)
• The rules are modular and it is easy to add new rules. Typically the rules make alarms of all old security breaches so that you cannot notice any new breaches.
Tecniche di Sicurezza dei Sistemi 19
Anomaly Detection
IDS principle of detectionIDS principle of detection
“Distinguish abnormal from normal”
Threshold Detection
• X events in Y seconds triggers the alarm
Statistical Measures
• Current traffic profile matches the ”normal” profile
Rule-Based Methods
• Jack never logs in at 6 to 8 AM
• If Jack just sent email from Espoo office, he should not send email from New York office at the same time
Tecniche di Sicurezza dei Sistemi 20
Anomaly/Misuse Detection – Comparison
IDS principle of detectionIDS principle of detection
Method Misuse Detection Anomaly DetectionTechnique Detect Patterns of Interest Deviations from Learned Norms
Generalization Problematic YesSpecifity Yes No
Sensitivity High ModerateFalse Alarms Low ModerateAdaptation No Yes
Tecniche di Sicurezza dei Sistemi 21
Responses
IDS response principlesIDS response principles
•Alerts and notifications: email, SMS, pager (important issue: alert path must be bulletproof)
•Increase Surveillance: log more
•Throttling: slow down malicious traffic
•Blocking Access: drop data, update firewall/router
• Make Counterattack: Eye for an eye tactics
•Honey Pots and Padded Cells: route the hacker to a fake system and let him play freely
Tecniche di Sicurezza dei Sistemi 22
Detection problemsIDS problems in the detection stageIDS problems in the detection stage
•True positive, TP, is a malicious attack that is correctly detected as malicious.•True negative, TN, is a not an attack and is correctly classified as benign.•False positive, FP, is not an attack but has been classified as an attack.•False negative, FN, is an attack that has been incorrectly classified as a benign.
Detection rate is obtained by testing the IDS against set of intrusive scenarios
“…The false alarm rate is the limiting factor for the performance in an IDS”.
Tecniche di Sicurezza dei Sistemi 23
Advanced IDS TechniquesAdvanced IDS Techniques
•Stream Reassembly: follow connections and sessions
•Traffic Normalization: see that protocols are followed
• Bayesian Networks: Data mining and decision networks
•Graphical IDSs (for example GrIDS): use graphs to model attacks
•Feature equality heuristics: port stepping, packet gap recognition
•Genetic Programming, Human immune systems
• Tens of research systems exist
For ProtectionFor Protection
For AttacksFor Attacks• Evasion methods (fragmentation, mutation etc.)
• IDS trashing (DoS tools to like stick/snot to crash IDS capability
Tecniche di Sicurezza dei Sistemi 24
Evaluation of IDS• Type I error: (false negative)
– Intrusive but not being detected
• Type II error: (false positive)– Not intrusive but being detected as intrusive
• Evaluation:– How to measure?– ROC - Receiver Operating Characteristics
curve analysis - detection rate vs. False alarm rate
– What else? Efficiency? “Cost?”
Tecniche di Sicurezza dei Sistemi 25
Example ROC Curve
• Ideal system should have 100% detection rate with 0% false alarm
% Detect
% False Alarm
IDS
Tecniche di Sicurezza dei Sistemi 26
Next Generation IDSs• Adaptive
– Detect new intrusions• Scenario-based
– Correlate (multiple sources of) audit data and attack information
• Cost-sensitive– Model cost factors related to intrusion
detection– Dynamically configure IDS components for
best protection/cost performance
Tecniche di Sicurezza dei Sistemi 27
Adaptive IDSs
IDSIDS
IDS IDModeling Engine anomaly data
anomaly anomaly detectiondetectionsemiautomaticsemiautomatic ID models
ID modelsID models
(misuse detection)(misuse detection)
Tecniche di Sicurezza dei Sistemi 28
Semi-automatic Generation of ID Models
models
raw audit data
packets/ events (ASCII)
connection/ session records
featurespatternsData miningData mining
LearningLearning
Tecniche di Sicurezza dei Sistemi 29
The Feature Construction Problemflagdst … service …
h1 http S0h1 http S0h1 http S0
h2 http S0
h4 http S0
h2 ftp S0
syn flood
normal
existing features existing features uselessuseless
dst … service …h1 http S0h1 http S0h1 http S0
h2 http S0
h4 http S0
h2 ftp S0
flag %S0707275
0
0
0
construct features construct features with high information with high information
gaingainHow? Use temporal and How? Use temporal and
statistical patterns, e.g., “a lot of statistical patterns, e.g., “a lot of S0 connections to same S0 connections to same
service/host within a short time service/host within a short time window”window”
Tecniche di Sicurezza dei Sistemi 30
Feature Construction Example
• An example: “syn flood” patterns (dst_host is reference attribute): – (flag = S0, service = http), (flag = S0, service =
http) (flag = S0, service = http) [0.6, 2s]– add features:
• count the connections to the same dst_host in the past 2 seconds, and among these connections,
• the percentage with the same service,
• the percentage with S0
Tecniche di Sicurezza dei Sistemi 31
An Adaptive IDS Architecture
FWQuick and Quick and
dirtydirty
Real-time IDS
Best-effort in Best-effort in real-timereal-time
Backend IDS
Thorough and Thorough and slow slow
(scenario/trend)(scenario/trend)
Dynamic Cost-sensitive
Decision Making
DetectionModels
Tecniche di Sicurezza dei Sistemi 32
Detecting Intruders• Commercially the most used IDS systems are probably
misuse based Network ID Systems, but Host-level IDS is also needed.
• As an example of a Host-level IDS let us look at LIDS for Linux.
• The philosophy of LIDS is to have a three layer protection:– Firewall– PortSentry– LIDS
• The firewall limits access to only allowed ports. In a Web-server only the TCP port 80 is absolutely necessary.
• Disable ports which are not used, for instance by removing the daemons or by modifying /etc/inetd.conf. Leave only the basic activities needed.
Tecniche di Sicurezza dei Sistemi 33
Detecting Intruders
• PortSentry is put to some port, which is often scanned but not used in the system.
• One should find suitable ports where to put PortSentry by looking at ports which are scanned often, like 143 or 111.
• Typically nowadays hackers do sweep scanning looking at only one port in several machines.
• PortSentry monitors activity on specific TCP/UDP ports. The PortSentry can take actions, like denying further access to the port.
Tecniche di Sicurezza dei Sistemi 34
Detecting Intruders
• This is based on the assumption that the hacker will first probe with a scanner the machine for weaknesses.
• You install PortSentry in TCP-mode by portsentry -tcp
• ports are in portsentry.conf -file.
Tecniche di Sicurezza dei Sistemi 35
Detecting Intruders
LIDS• LIDS is an intrusion detection system
that resides in the Linux kernel.
• It basically limits the rights of a root user to do modifications. It limits root access to direct port access, direct memory access, raw access, modification of log files, limits access to file system. It also prevents installation of sniffers or changing firewall rules.
Tecniche di Sicurezza dei Sistemi 36
Detecting Intruders
LIDS• An administrator can remove the
protection by giving a password to LIDS, but if a hacker breaks into the root, he cannot without LIDS password do much damage.
• Is this good? it certainly makes the life of a hacker more difficult, but what about a hacker getting into the kernel?
• How nice it is being an administrator using LIDS?