Network Security: The Principles of Threats, Attacks and - apricot

42 Pages·2004·11.03 MB·English

Network Security: The Principles
of Threats, Attacks and Intrusions
(Part 2)
APRICOT 2004
Tutorial, 24 February 2004
Kuala Lumpur
Ray Hunt, Associate Professor (Networks and
Security), University of Canterbury,
New Zealand 1
What is an Intrusion?
Sequence of related actions by a malicious
adversary that results in occurrence of security
threats to target computer or network
Indicators:
(cid:1)
Repetition of unusual behaviour
(cid:1)
Exploitation of known vulnerabilities
(cid:1)
Inconsistent packet sequences or routes
(cid:1)
Unexplained problems
(cid:1)
Suspicious traffic content
2
Major Reasons for Using Intrusion
Detection Systems are..
(cid:1)
To detect intruders, attacks, abuse...
(cid:1)
To detect probes
(cid:1)
To provide active network security
(cid:1)
To provide a means of deterrent
(cid:1)
To collect data on system behavior so
as to recover after intrusion
(cid:1)
To indirectly provide useful information
3
History of IDS
Developments/Products
4
IDS Goals
• Differentiate normal from damaging actions
• Scalable
• Variety of network systems and architectures
• Adapts in response to new attacks
• Reports attacks in real-time
• Co-operates with other security mechanisms
5
IDS Goals
• Increase monitoring at suspicious points
• Protect against being attacked itself
• Function in face of network failure
X
• Minimal performance impact
• Generate audit information
• Reflect security policy of organisation
6
IDS Architecture
7
IDS Architecture Components
• Sensors - data gathering for the IDS
• Monitors - process the collected data
• Resolver - determines appropriate responses
• Controller - configuration of components in a
distributed system
Modern IDS apply these components in a cascading
fashion, ie - allowing higher level system overviews to
be gained as a user ascends through the tree
8
IDS Techniques
• Misuse Detection (M-IDS) - attempts to match
observed v expected behaviour (eg signature
analysis, Petri nets, state transition diagrams,
genetic algorithms)
• Anomaly Detection (A-IDS) - models expected
behaviour (eg statistical, expert systems, neural
networks)
9
IDS Techniques
• Location of Sensors - network-based (no
processing overheads and difficult to attack) or
host-based (performance impact but good data
collection)
• Monitor Processing Patterns - real-time (cf. batch)
detection of significant benefit (performance issues)
• Distributed Correlation - simple interfaces (eg
Shadow) or hierarchical (eg GrIDS)
10