Intrusion Detection Systems and Intrusion Prevention Systems

1
Intrusion Detection Systems (IDS)
&
Intrusion Prevention Systems (IPS)
Prepared by Cleverence Kombe

Outline
Introduction
Intrusion Detection Prevention Systems
Classes of Detection Methodologies
Types of IDPSs
Conclusion
2

• Intrusions: attempts to compromise the confidentiality, integrity,
availability, or to bypass the security mechanisms of a computer
system or network( illegal access).
• Intrusions have many causes, such as malware (worms, spyware,
etc…), attackers gaining unauthorized access to systems from the
Internet, and authorized users of systems who misuse their privileges
or attempt to gain additional privileges for which they are not
authorized.
• Although many intrusions are malicious in nature, many others are not;
for example: a person might mistype the address of a computer and
accidentally attempt to connect to a different system without
authorization.
3
Introduction

• Intrusion detection: is the process of monitoring the events
occurring in a computer system or network and analyzing them for
signs of possible intrusions (incidents).
• Intrusion detection system (IDS): is software that automates the
intrusion detection process. The primary responsibility of an IDS is to
detect unwanted and malicious activities.
• Intrusion prevention system (IPS): is software that has all the
capabilities of an intrusion detection system and can also attempt to
stop possible incidents.
4
Introduction

Introduction…
• Intrusion Detection Systems (IDSs) will be obsolete very soon (if they
aren't already). In it's place is something much more capable, an
Intrusion Prevention System (IPS).
• IPSs are not a new technology, they are simply an evolved version of
IDS.
• IPSs combine IDSs and improved firewall technologies, they make
access control decisions based on application content, rather than
IP address or ports as traditional firewalls had done.
• Because IDS and IPS technologies offer many of the same
capabilities, administrators can usually disable prevention features
in IPS products, causing them to function as IDSs.
5

Intrusion Detection Prevention
Systems
• It’s a dire fact that while every enterprise has a firewall, most still
suffer from network security problems. IT professionals are acutely
aware of the need for additional protective technologies, and
network equipment vendors are anxious to fill in the gap.
• Intrusion Prevention Systems have been promoted as cost-effective
ways to block malicious traffic, to detect and contain worm and
virus threats, to serve as a network monitoring point, to assist in
compliance requirements, and to act as a network sanitizing
agent.
6

Intrusion Detection Prevention
Systems
IDSs are primarily focused on:
• Identifying possible incidents, logging information about them,
attempting to stop them, and reporting them to security
administrators.
• Identifying problems with security policies
• Documenting existing threats
• Deterring individuals from violating security policies.
7

Additionally, IDSs perform the following:
• Recording information related to observed events. Information is usually
recorded locally, and might also be sent to separate systems such as
centralized logging servers, security information and event
management (SIEM) solutions, and enterprise management systems.
• Notifying security administrators of important observed events. This
notification, known as an alert, may take the form of audible signals, e-
mails, pager notifications, or log entries. A notification message typically
includes only basic information regarding an event; administrators need
to access the IDPS for additional information.
• Producing reports. Reports summarize the monitored events or provide
details on particular events of interest.
8
Intrusion Detection Prevention Systems

• Stops the attack itself. Examples:
Terminate the network connection or user session that is being used for
the attack. Block access to the target (or possibly other likely targets) from
the offending user account, IP address, or other attacker attribute. Block all
access to the targeted host, service, application, or other resource.
• Changes the security environment. The IPS could change the
configuration of other security controls to disrupt an attack. Such as
reconfiguring a network device (e.g., firewall, router, switch) to block access
from the attacker or to the target, and altering a host-based firewall on a
target to block incoming attacks. Some IPSs can even cause patches to
be applied to a host if the IPS detects that the host has vulnerabilities.
9
IPSs perform the following:

• Changes the attack’s content. Some IPS technologies can remove or replace
malicious portions of an attack to make it benign. An example is an IPS removing
an infected file attachment from an e-mail and then permitting the cleaned email
to reach its recipient.
• Most IDPSs also offer features that compensate for the use of common
evasion techniques. Evasion is modifying the format or timing of malicious
activity so that its appearance changes but its effect is the same. Attackers use
evasion techniques to try to prevent IDPSs from detecting their attacks.
• For example: an attacker could encode text characters in a particular way,
knowing that the target understands the encoding and hoping that any
monitoring IDPSs do not. Most IDPSs can overcome common evasion techniques
by duplicating special processing performed by the targets. If the IDPS can “see”
the activity in the same way that the target would, then evasion techniques will
generally be unsuccessful at hiding attacks.
10
IPSs perform the following:

Classes of Detection
Methodologies
• Signature-based: compares known threat signatures to observed
events to identify incidents.
• This is very effective at detecting known threats but largely ineffective at
detecting unknown threats and many variants on known threats.
• Signature-based detection cannot track and understand the state of complex
communications, so it cannot detect most attacks that comprise multiple
events.
Examples:
• A telnet attempt with a username of “root”, which is a violation of an organization’s
security policy
• An e-mail with a subject of “Free pictures!” and an attachment filename of
“freepics.exe”, which are characteristics of a known form of malware
11

• Anomaly-based detection: sample network activity to compare to
traffic that is known to be normal.
• When measured activity is outside baseline parameters or clipping
level, IDPS will trigger an alert.
• Anomaly-based detection can detect new types of attacks.
• Requires much more overhead and processing capacity than
signature-based
• May generate many false positives. 12
Methodologies

• Stateful protocol analysis: A key development in IDPS
technologies was the use of protocol analyzers.
• Protocol analyzers can natively decode application-layer network
protocols, like HTTP or FTP. Once the protocols are fully decoded, the
IPS analysis engine can evaluate different parts of the protocol for
anomalous behavior or exploits against predetermined profiles of
generally accepted definitions of benign protocol activity for each
protocol state.
• Problems with this type include that it is often very difficult or
impossible to develop completely accurate models of protocols, it
is very resource-intensive, and it cannot detect attacks that do not
violate the characteristics of generally acceptable protocol behavior.
13
Methodologies

Types of IDPSs
1. Network-based: perform packet sniffing and analyze network
traffic to identify and stop suspicious activity. They are typically
deployed inline. Like a network firewall. They receive packets,
analyze them, decide whether they should be permitted, and allow
acceptable packets to pass through.
• Allow some attacks ,such as network service worms, e-mail.borne
worms and viruses with easily recognizable characteristics (e.g.,
subject, attachment filename), to be detected on networks before
they reach their intended targets (e.g., e-mail servers, Web
servers).
• Most products use a combination of attack signatures and analysis
of network and application protocols. 14

• Network-based products might be able to detect and stop some
unknown threats through application protocol analysis.
• Some products allow administrators to create and deploy attack
signatures for many major new malware threats in a matter of minutes.
Although poorly written signature triggers false positives that block
benign activity, a custom signature can block a new malware threat
hours before antivirus signatures become available.
• However, network-based products are generally not capable of
stopping malicious mobile code or Trojan horses.
15
Types of IDPSs

Placement of Network IDPSs
 Deployment options:
• Outside firewall
• Just inside firewall
-Combination of both will detect attacks getting through
firewall and may help to refine firewall rule set.
• Behind remote access server
• Between business units
• Between corporate network and partner networks
 Sensors may need to be placed in all switched
network segments
16
Types of IDPSs

17
Placement of Network IDPSs
Types of IDPSs

2. Host-based: are similar in principle and purpose to network-based ,
except that a host-based product monitors the characteristics of
a single host and the events occurring within that host, such as
monitoring network traffic (only for that host), system logs,
running processes, file access and modification, and system
and application configuration changes.
• They often use a combination of attack signatures and
knowledge of expected or typical behavior to identify known
and unknown attacks on systems.
• If a host-based product monitors the host’s network traffic, it offers
detection capabilities similar to a network-based.
18
Types of IDPSs

• Host-based IDPSs are most commonly deployed on critical hosts
such as publicly accessible servers and servers containing sensitive
information.
• For example: attempted changes to files can be effective at
detecting viruses attempting to infect files and Trojan horses
attempting to replace files, as well as the use of attacker tools,
such as rootkits, that often are delivered by malware.
19
Types of IDPSs

Deployment options:
• Key servers that contain mission-critical and
sensitive information.
• Web servers.
• FTP and DNS servers.
• E-commerce database servers, etc.
• Other high value assets.
May also emplace these randomly to obtain probabilistic measure of hosts
becoming compromised.
20
Placement of Host IDPSs
Types of IDPSs

21
Placement of Host IDPSs
Types of IDPSs

3. Network Behavior Analysis (NBA): examines network traffic to
identify threats that generate unusual traffic flows, such as denial
of service (DoS) and distributed denial of service (DDoS) attacks,
certain forms of malware (e.g., worms, backdoors), and policy violations
(e.g., a client system providing network services to other systems).
• NBA systems are most often deployed to monitor flows on an
organization’s internal networks, and are also sometimes deployed
where they can monitor flows between an organization’s networks
and external networks (e.g., the Internet, business partners’
networks).
22
Types of IDPSs

4. Wireless: monitors wireless network traffic and analyzes its
wireless networking protocols to identify suspicious activity
involving the protocols themselves.
• It cannot identify suspicious activity in the application or higher-
layer network protocols (e.g., TCP, UDP) that the wireless network
traffic is transferring.
• It is most commonly deployed within range of an organization’s
wireless network to monitor it, but can also be deployed to
locations where unauthorized wireless networking could be
occurring.
23
Types of IDPSs

• organizations should consider using multiple types of IDPS
technologies to achieve more comprehensive and accurate
detection and prevention of malicious activity.
• For most environments, a combination of network-based and host-
based IDPSs is needed for an effective IDPS solution.
• NBA technologies can also be deployed if organizations desire
additional detection capabilities for DoS & DDoS attacks, worms,
and other threats that NBAs are particularly good at detecting.
• Wireless IDPSs may also be needed if the organization determines
that its wireless networks need additional monitoring or if the
organization wants to ensure that rogue wireless networks are not
in use in the organization’s facilities.
24
Types of IDPSs

• Before evaluating IDPS products organizations need to understand
the characteristics of their system and network environments, so
that a compatible IDPS can be selected that can monitor the events
of interest on the systems and/or networks.
• Organizations should articulate the goals and objectives they wish
to attain by using an IDPS, such as stopping common attacks,
identifying misconfigured wireless network devices, and
detecting misuse of the organization’s system and network
resources.
• Organizations should also review their existing security policies, which
serve as a specification for many of the features that the IDPS
products need to provide. 25
Conclusion

26
END OF THE PRESENTATION
Thank You

Intrusion Detection Systems and Intrusion Prevention Systems

More Related Content

What's hot (20)

Viewers also liked (20)

Similar to Intrusion Detection Systems and Intrusion Prevention Systems (20)

Recently uploaded (20)

Intrusion Detection Systems and Intrusion Prevention Systems