Intrusion Detection System (IDS) / Intrusion Prevention System (IPS)

Types of Intrusion Detection Systems
An Intrusion Detection System (IDS) is a program that analyzes what happens or has
happened during an execution and tries to find indications that the computer has been
misused. An IDS detects and records evidence of intrusion activity that passes through the firewall, whether ultimately successful or not. When an attack occurs, IDS software helps you determine what happened and how to prevent the breach from recurring. Some IDSs can instruct other parts of the network infrastructure to shut down attacks in progress. However, IDSs are reactive--they report what has happened--and can only detect activity on the links they monitor. And IDS is not a "set it and forget it" technology, either. Firewalls and intrusion detection systems (IDS) are essential parts of a small or medium-size business's (SMB) network and its security. With the number of attacks on SMBs on the rise, a robust system is equally important for an SMB as it is for a large enterprise. And despite the challenges of recent Web and application-level attacks, a strong perimeter defense of firewalls -- as old-fashioned as it may sound -- is still necessary to protect your SMB.

Distributed IDS
A Distributed IDS (DIDS) consists of several IDS over a large network(s), all of which communicate with each other, or with a central server that facilitates advanced network monitoring. In a distributed environment, DIDS are implemented using co-operative intelligent agents distributed across the network(s)

Setting Up an IDS
Setting up firewalls is part of a day's work for networking types, and they should already have the appropriate skills without having to look for dedicated security professionals. So where do you set up an IDS? That depends on where (from which network or network segment) you expect threats to originate. The most obvious location is at the network perimeter, just inside the firewall. That's a hotspot because traffic that doesn't get through the firewall is of no interest, and any logging system that captures unfiltered Internet activity is likely to fill up quickly. Positioning an IDS inside the firewall helps you understand attacks that originate outside your network. It may not, however, cover exploits that originate from inside your network targeting your hosts, depending on your network's topology.

Managing an IDS
Intrusion detection is not for the faint at heart. But, if you are a network administrator chances are you're under increasing pressure to ensure that mission-critical systems are safe--in fact impenetrable--from malicious code, buffer overflows, stealth port scans, SMB probes, OS fingerprinting attempts, CGI attacks, and other network intruders. Designing a reliable way to detect intruders before they get in is a vital but daunting challenge. Because of this, a plethora of complex, sophisticated, and pricy software solutions are now available. In terms of raw power and features, SNORT, the most commonly used Open Source Intrusion Detection System, (IDS) has begun to eclipse many expensive proprietary IDSes. In terms of documentation or ease of use, however, SNORT can seem overwhelming. Which output plugin to use? How do you to email alerts to yourself? Most importantly, how do you sort through the immense amount of information Snort makes available to you? Many intrusion detection books are long on theory but short on specifics and practical examples. Not Managing Security with Snort and IDS Tools. This new book is a thorough, exceptionally practical guide to managing network security using Snort 2.1 (the latest release) and dozens of other high-quality open source other open source intrusion detection programs. Managing Security with Snort and IDS Tools covers reliable methods for detecting network intruders, from using simple packet sniffers to more sophisticated IDS (Intrusion Detection Systems) applications and the GUI interfaces for managing them. A comprehensive but concise guide for monitoring illegal entry attempts, this invaluable new book explains how to shut down and secure workstations, servers, firewalls, routers, sensors and other network devices. Step-by-step instructions are provided to quickly get up and running with Snort. Each chapter includes links for the programs discussed, and additional links at the end of the book give administrators access to numerous web sites for additional information and instructional material that will satisfy even the most serious security enthusiasts. Managing Security with Snort and IDS Tools maps out a proactive--and effective--approach to keeping your systems safe from attack.




Case study & Tips for administering a firewall
1. Keep all databases, or other systems with confidential customer information, tucked away inside your internal network and not in your DMZ. The same goes for any encryption keys or other mission-critical internal systems you wouldn't want exposed to the outside world.

2. Use your networking staff to administer your firewalls and IDS if you don't have a dedicated information security team. Setting up firewalls is part of a day's work for networking types, and they should already have the appropriate skills without having to look for dedicated security professionals. Set up paging on your IDS to alert networking staff members of intrusion attempts and possible incidents.

3. Establish firewall rules as a joint effort between the business and IT (or networking) staff. Make sure they work for everyone and aren't too restrictive or too open. Policies must include what types of applications and traffic are allowed into and out of your network through your firewalls.

4. Have regular audits and log reviews to tune up your perimeter defenses and see if there are patterns in the types of attempted intrusions.

Vendors that offer affordable firewalls for small or medium-sized businesses include Juniper Networks Inc., SonicWALL Inc., NetScreen and Check Point Software Technologies Ltd. They're all nimble enough for small players and can be set up as part of a dual firewall system. Cisco PIX also offers a line of firewalls for the smaller enterprise. On the IDS side, Nessus and Snort are two popular products that are lightweight enough for small networks but strong enough to have stood the test of time.

IDS Techniques

This posting will summarize the interesting techniques used in IDS system for both software IDS and hardware IDS (appliance).


Signature Detection
In this technique known representations of intrusions are stored in the IDS and are then compared to the system activity. When a known intrusion matches these signatures, an alert is raised. Signatures must be created to exactly match the characteristics (protocols or the contents of traffic) of a specific intrusion and no other activities to avoid false positives. This technique is most accurate for detecting known attacks e.g. DoS attack.

Signature engines also have their disadvantages. Because they only detect known attacks, a signature must be created for every attack, and novel attacks cannot be detected. Signature engines are also prone to false positives since they are commonly based on regular expressions and string matching. Both of these mechanisms merely look for strings within packets transmitting over the wire.


Anomaly Detection
An Anomaly-Based IDS, is a system for detecting computer intrusions and misuse by monitoring system activity and classifying it as either normal or anomalous. The classification is based on heuristics or rules, rather than patterns or signatures, and will detect any type of misuse that falls outwith normal system operation. This is as opposed to signature based systems which can only detect attacks for which a signature has previously been created.

Anomaly detection detects a misuse by measuring norm overtime and then generating alert when a pattern differs from a norm. In this technique a set of data is gathered from the system activity of the user and this data set is base lined. If the flow of traffic deviates from the base lined data set pattern an alarm is raised.

A disadvantage of anomaly-detection engines is the difficultly of defining rules. Each protocol being analyzed must be defined, implemented and tested for accuracy. The rule development process is also compounded by differences in vendor implementations of the various protocols. Custom protocols traversing the network cannot be analyzed without great effort. Moreover, detailed knowledge of normal network behavior must be constructed and transferred into the engine memory for detection to occur correctly. On the other hand, once a protocol has been built and a behavior defined, the engine can scale more quickly and easily than the signature-based model because a new signature does not have to be created for every attack and potential variant.


Target Monitoring
Target monitoring works by means of generating a cryptographic hash for every file on the system and periodically comparing that hash to the original file to ensure that no change has occurred. This type of system is the easiest to implement, because it does not require constant monitoring by the administrator. Integrity checksum hashes can be computed at whatever intervals we wish on either all files or just the critical files.


Stealth Probes
Stealth probe technique attempts to detect any attackers that choose to carry out their mission over prolonged periods of time. Attackers, for example, will check for system vulnerabilities and open ports over a two-month period, and wait another two months to actually launch the attacks. This technique will collect a wide-variety of data throughout the system, checking for any methodical attacks over a long period of time. They take a wide-area sampling and attempt to discover any correlating attacks.


Conclusion
However, anomaly detection has an advantage over signature-based engines in that a new attack for which a signature does not exist can be detected if it falls out of the normal traffic patterns. The best example of this is how such systems detect new automated worms. When a new system is infected with a worm it usually starts scanning for other vulnerable systems at an accelerated or abnormal rate flooding the network with malicious traffic, thus triggering a TCP connection or bandwidth abnormality rule.

Five major types of IDS

Intrusion Detection System as the name implies detects intrusion in the network. It implies both intrusions from inside and from outside the network.
IDS, these days, have become vital component in the security toolbox.

This posing will provide an overview of IDS, their types, detection techniques employed and various popular IDS tools that are widely used. This report also gives the overview of Snort IDS tool followed by a short demo showing the actual working of snort to catch intrusion based on the rules set. The intent of this presentation and report is to make the audience aware of the importance of IDS and also to make them familiar with the usage of Snort IDS tool.


Introduction
Intrusion Detection System is any hardware, software, or a combination of both that monitors a system or network of systems against any malicious activity. This is mainly used for detecting break-ins or misuse of the network. In short, we can say that IDS is the ‘burglar alarm’ for the network because much like a burglar alarm, IDS detects the presence of an attack in the network and raises an alert. An IDS provides three functions: monitoring, detecting and generating an alert.

IDS are often considered as the functionality of firewall. But there is a thin line of difference between them. A firewall must be regarded as a fence that protects the information flow and prevent intrusions where as IDS detects if the network is under attack or if the security enforced by the firewall has been breached. Together firewall and IDS enhance the security of network.

Intrusion Detection System uses a security policy (or rules) to detect unusual activity. These rules are defined by the administrator based on the needs of the organization. Any activity that violates this security policy will be considered a security threat and will be reported to the administrator via email or as page or as SNMP traps. These policies must be updated regularly to keep up with the threats and needs.

Of the security incidents that occur on a network, the vast majority (up to 85 percent by many estimates) come from inside the network. These attacks may consist of otherwise authorized users who are disgruntled employees. The remainder come from the outside, in the form of denial of service attacks or attempts to penetrate a network infrastructure. Intrusion detection systems remain the only proactive means of detecting and responding to threats that stem from both inside and outside a corporate network.

Types of IDS
There are three main types of Intrusion Detection Systems:
• Host Based
• Network Based
• Stack Based
• Signature Based
• Anomaly Based

Host Based IDS
Intrusion Detection System is installed on a host in the network. HIDS collects and analyzes the traffic that is originated or is intended to that host. HIDS leverages their privileged access to monitor specific components of a host that are not readily accessible to other systems. Specific components of the operating system such as passwd files in UNIX and the Registry in Windows can be watched for misuse. There is great risk in making these types of components available to NIDS to monitor.

Although HIDS is far better than NIDS in detecting malicious activities for a particular host, they have limited view of entire network topology and they cannot detect attack that is targeted for a host in a network which does not have HIDS installed.


Network Based IDS
Network IDSs (NIDS) are placed in key areas of network infrastructure and monitors the traffic as it flows to other host. Unlike HIDS, NIDS have the capability of monitoring the network and detecting the malicious activities intended for that network. Monitoring criteria for a specific host in the network can be increased or decreased with relative ease.

NIDS should be capable of standing against large amount number of network traffic to remain effective. As network traffic increases exponentially NIDS must grab all the traffic and analyze in a timely manner.


Stack Based IDS
Stack based IDS is latest technology, which works by integrating closely with the TCP/IP stack, allowing packets to be watched as they traverse their way up the OSI layers. Watching the packet in this way allows the IDS to pull the packet from the stack before the OS or application has a chance to process the packets.


Signature-Based IDS
Signature-Based IDS use a rule set to identify intrusions by watching for patterns of events specific to known and documented attacks. It is typically connected to a large database which houses attack signatures. It compares the information it gathers against those attack signatures to detect a match.

These types of systems are normally presumed to be able to detect only attacks “known” to its database. Thus, if the database is not updated with regularity, new attacks could slip through. It can, however, detect new attacks that share characteristics with old attacks, e.g., accessing 'cmd.exe' via a HTTP GET request. But, in cases of new, uncataloged attacks, this technique is pretty porous.

Also, signature based IDS’s may affect performance in cases when intrusion patterns match several attack signatures. In cases such as these, there is a noticeable performance lag. Signature definitions stored in the database need to be specific so that variations on known attacks are not missed. This sometimes leads to building up of huge databases which eat up a chunk of space.


Anomaly Based IDS
Anomaly-Based IDS examines ongoing traffic, activity, transactions and behavior in order to identify intrusions by detecting anomalies.

It works on the notion that “attack behavior” differs enough from “normal user behavior” such that it can be detected by cataloging and identifying the differences involved.

In most anomaly-based IDS’s the system administrator defines the baseline of normal behavior. This includes the state of the network's traffic load, breakdown, protocol, and typical packet size.

Anomaly detectors monitor network segments to compare their state to the normal baseline and look for current behavior which deviate statistically from the normal. This capability theoretically gives anomaly-based IDSs abilities to detect new attacks that are neither known nor for which signatures have been created.

On the other hand, anomaly-based IDS systems have been known to be prone to a lot of false positives. In these cases, the attacks are reported based on changes to the current system on which the IDS is installed. This is because there is a change in the normal state of the system which is not perceived by the IDS.

Sometimes, anomaly-based IDS systems can cause heavy processing overheads on the computer system they are installed on. It takes a short period of time for anomaly-based systems to create statistically significant baselines. During this period, they are relatively open to attack.