Intrusion Detection System (IDS) (Part 2)

Classify; methods and techniques

In the previous section we have solved IDS architectural and classification issues. In this second part, we will show you more in-depth tutorials on IDS including an overview of classifications and an introduction to the reader some basic concepts about IDS: audit analysis and 'online' processing as well as anomalous detection and detection methods. We will also introduce key detection techniques. Classification of intrusion detection systems First of all IDS intrusion detection system involves the detection of attack operations. Therefore this network security tool uses both main techniques. The first technique is to detect anomalies To find out the intrusion detection problem related to the wrong commands compared to the normal system or in user behavior. The second technique uses signal detection to distinguish between unusual attack patterns and signs of known intrusion detection. Both methods have advantages and disadvantages as well as reasonable application. When considering the data storage area used for intrusion detection, we have another classification used here as a protected system type. The IDS tool group uses information obtained from a host (system) - IDS host (HIDS) and IDSs to use information obtained from the local network segment (network IDS). The two main types of HIDS can be distinguished as: - The system checks incoming connection attempts (RealSecure Agent, PortSentry). This system checks incoming and outgoing network connections of a host. There is an association of unauthorized connection attempts with TCP or UDP ports and can also detect incoming port scans. - Systems that check network traffic (network packets) are trying to access the host. These systems protect the host by blocking suspicious packets and consider the payload issue of the link (packet inspection). - Systems that check log activity to the network layer of the protected host (HostSentry). This role is to test attempts to log in and log out, look for unusual activities on a system at unexpected intervals, specific network locations or detect multiple attempts to post. enter (typically attempts to fail). - The system checks super user activities, the highest priority (check the record). IDS scans abnormal activities, super user activity is increased or operations have been performed at specific times,. - File integrity checking system (Tripwire, AIDE). Tools with this capability (integrity checker) allow to detect any changes that occur to important files for the operating system. - System to check register status (Windows system only). They are designed to detect any invalid changes in system registers and alerts for system administrators. - Kernel-based intrusion detection system is popular with Linux (LIDS, OpenWall). These systems check the main state of the file and the flow of the operating system, to prevent buffer overflows, block abnormal communications, prevent intrusion attacks on the system. In addition, they can block some activities that only super-users have (query rights). HIDS reside on a specific computer and provide protection for certain computer systems. They are not only equipped to facilitate easy system testing, but also include other typical IDS modules, As an example,, response modules (see Part 1). HIDS products like Snort, Dragon Squire, Emerald eXpert-BSM, NFR HID, Intruder Alert, all carry this type of test. Type IDS - network (NIDS) provides data about internal network performance. NIDS gather packages and analyze them. They not only handle packages that are sending to specific hosts but can also be installed on active network components, As an example, on routers. Because intrusion detection uses statistical data on network payloads, a declared NIDS can be clearly distinguished, such as traffic monitors (Novell Analyzer, Microsoft Network Monitor). They collect all the packets they see on the network segment without analyzing them and only focus on creating network traffic statistics. Typical network intrusion systems are: Cisco Secure IDS (formerly known as NetRanger), Hogwash, Dragon, E-Trust IDS. Some authors consider the mix of HIDS and NIDS as a separate layer with Network Node IDS (NNIDS), Network Node IDS (NNIDS) that have deployment agents on each host within the network (typical NIDS use operative network to check all LAN segments). In fact, an NNIDS acts like a hybrid host NIDS because the agent typically handles network traffic directly to the host it runs on. The main reason for introducing hybrid IDS is to use it when online with encrypted networks and data intended for a host (only the source and destination can view encrypted network traffic. ). Most intrusion detection systems provided to the commercial sector are often hybrid tools,. This can see the power of HIDS and NIDS in a single concept. HIDS observe their host traffic and can easily detect local-to-local attacks or local-to-root attacks, because they have a clear concept of proper internal information, As an example,: they can exploit user IDS. Also, anomalous detection tools have better coverage for internal problems because their detection capabilities are based on a user's normal behavior pattern. IDS can operate independently within centralized or integrated applications to create a distributed system. Recently we have a special architecture with autonomous agents that can take precedence and react to measured parameters, can even move across the network. The AAFID architecture of these systems is presented in Part 1. It is possible to classify an infringing detection system under their behaviors, be it passive (simply by giving warning and network log packets) or can be positive - that is, possible Detects and responds to attacks, attempts to patch software vulnerabilities before being attacked, preemptively log off potential intruders, or block services. This section will be discussed in section 3.

Figure 1 : Classification of intrusion detection systems

Processing online verification IDS can operate either continuously or cyclically (respectively real-time IDS and interval IDS), so they use two different intrusion detection methods. Audit analysis is a common method used by operating systems periodically. In contrast, IDS can be deployed in a real-time environment designed for online testing and analysis of system events and user activity. Handling inspection There are many issues related to verification processing (event logs). Storing audit reports must avoid archiving in files because intruders can use that feature to create many unwanted changes. A certain number of event logs should be kept on the network, although it may have to add overhead to both the system and the network. In addition, recording each event means consuming a bit of system resources (both internal and network related). Therefore, performing log compression will be a way to increase system load. Specifying verified events is a difficult issue because there are many types of attacks that may not be detected. It is also difficult to predict how large the file size must be because experienced people can only create an estimate from start to finish. Also, an appropriate save cycle setting for current audit files is not an easy task. In general, this depends on the specific IDS solution and its correlation engine. Obviously, archived files need to be saved as copies for recovery analysis purposes. Log processing systems may also have vulnerabilities in denial-of-service (DoS) attacks, from which they provide authentication mechanisms that are not authentic and irrelevant due to overflow of system space.. The main reasons for this appraisal function are:

• Detecting offensive manifestations to analyze and draw experiences;
• Detect periodic intrusion activities;
• Distinguish successful attacks;
• Distinguish weaknesses of the system itself;
• Expanding user access and signs, defining important rules for network traffic for IDS to detect abnormal signs.
• Repel potential attacks simply by making them aware of the existence of the meaning of testing.
• Inspection reports can provide a form of prevention for legitimate users.
• Log event IDS method should have the following capabilities:
• Giving event log and user activity parameters an easy way, provides binding options for event logging mechanisms when there is no free space or DoS attack.
• Verification processing needs to use additional mechanisms (retrieval, fake information and minimum data) because the file size is very large.
• Minimum system resource consumption can be allowed for verification purposes.

Examples of intrusion detection systems that use audit processing are:

• SecureView to check the logs provided by CheckPoint Firewall-1
• CMDS ( Computer Misuse Detection System ). With an accompanying expert system, it will analyze all event logs to recognize unusual user behavior.
• ACID ( Analysis Console for Intrusion Databases ) - is an analytical PHP database for searching and processing databases of incidents created with various security tools like IDS, firewall and network traffic analyzers. ACID has a user queue generator, which can analyze packages in its payload, thus finding the right warnings between databases, which is done with which standard combination there. It can also manage alerts and create statistics.

Process online With online processing, an IDS performs online system authentication. In general, the network packet stream will be checked continuously. With this type of processing, intrusion detection uses knowledge of the current activity on the network to identify possible attack attempts (if it doesn't find a successful attack in the past). This creates complexity in computation, the algorithms used here must require fast and effective therefore simple algorithms must be applied. This is due to the response between the key conditions - the ability to detect attacks and the complexity of the data processing mechanisms used in them. At the same time, setting up an 'online' IDS tool requires a large amount of RAM because no data storage is used here. Therefore, such an IDS sometimes misses packages because in fact, there are too many packages that don't fit. The amount of data selected by the detector is very small because it only observes the memory contents. So only a small part of the information is analyzed for a string or value that is being searched. The main method used in real-time detection is simply to search for character strings in the transport layer package, namely in their headers. This can be done by checking the IP addresses that initiate the connection or by checking the combination of inappropriate TCP / IP flags (to catch packets that do not conform to known standards). An example of packet research here is when the source and destination port addresses are set to 21. This does not follow the FTP specifications because the source port number must be greater than 1024. Another example may be is a type of service with a value of 0, a package with SYN and FIN flags are set not to match the numbering of the string or what is known, the ACK value is set to be different from zero when the ACK flag is not set,. In contrast to standard verification methods, only select packages in the data stream that are disputed and the inspection process only looks for status information such as whether the package includes malicious code. Another method is somewhat applied in application layer analysis (FTP, POP3, HTTP,.). Application-based IDS uses standard package checks to analyze TCP payloads (including headers). With this method, the relevant packages in the data stream are checked and the test process looks for information about which packets are valid for the typical package (commands) of a given protocol. Thus, POP3 denial of service vulnerability is exploited by saturating the POP3 server with multiple requests to execute a command. Therefore, the attack signal is expanded by the number of commands sent by a system and alarm threshold. This method recognizes the anomaly found while checking packages, checking package size and threshold values is to find signs of denial of service attacks, also at the transport layer. Other examples of standard packet inspection IDS also have the detection of email viruses before they reach the mailboxes by looking for a valid email title or attachment name. A tool that can search for malicious code can compromise the system if it is attacked, As an example,, exploits for buffer vulnerabilities are looking for signs to check the user session state to prevent, List the directory structure on an FTP server before a user logs in successfully. One obstacle to the high-class analysis method lies in the fact that it is time-consuming and dependent on the working environment (application layer protocols vary in different operating systems). Advantages of real-time IDS:

• Better about detecting attacks and even processing them;
• The ability to cover successive security vulnerabilities has been pre-existing for specific types of attacks, such as DoS, that cannot be detected by using general inspection analysis - network traffic analysis is needed. here;
• Consume less system resources than other cases.

Weakness:

• Resource identification is done based on the network address taken from the package (As an example,, do not use a network ID). Resource addresses can be tampered with, making attacks more difficult to track and handle automatically.
• Encrypted packages cannot be managed so they do not provide the information needed for intrusion detection.
• Because the analysis module uses limited resources (only in the buffer), the detection capability is limited accordingly.
• Continuous scanning of network traffic will reduce network throughput. This is an important issue when IDS tools are deployed near firewalls.

Unusual signs detected The intrusion detection system must be able to distinguish between normal user activities and abnormal operations to find dangerous attacks in time. However, translating user behaviors (or complete user system sessions) in a decision related to security is often not straightforward - many behaviors are not intended and unclear ( Figure 2). To classify actions, IDS must take advantage of anomalous detection methods, sometimes basic behavior or attack signs, etc. a device describing known abnormal behavior (detection of a sign). Also called basic knowledge.

Figure 2 : User behavior in the system

Common behavior patterns - abnormal detection Common behavior patterns are useful in predicting users and system behavior. Therefore, abnormal detectors build profiles that show normal usage and then use common behavioral data to detect invalidations between profiles and identify possible attacks. To be reasonable with event profiles, the system is required to create the initial user profile to 'train' the system with regard to legalizing user behavior. There is a problem with profile making here: when the system is allowed to 'learn' on itself, intruders can also train the system at this point, where the infringement acts. before becoming normal behavior. An incompatible profile will be able to detect all possible intrusion activities. In addition, there is another need to upgrade the profile and "train" the system, a difficult and time-consuming task. Given a set of common behavioral profiles, everything that doesn't match the saved profile will be treated as a suspicious activity. Therefore, these systems are characterized by very high detection efficiency (they can recognize many attacks even though the attack is new to the system), but they do have the phenomenon of creating scenes. Falsely reported some problems. The advantage of this unusual detection method is: being able to detect new attacks when there is an intrusion; Unusual problems are realized without their inner cause and personality; less dependent on IDS for operating environments (when compared to sign-based systems); ability to detect abuse of user rights. The biggest disadvantages of this method are:

• Probability of many false alarms. System performance is not checked during profile building and training phase. Therefore, all user activities ignored during this period will be unreasonable. User behaviors may change over time, so there is a need for a continuous upgrade to the usual behavioral profile database.
• The need for system training when changing behavior will make the system unrecognizable during the training period. (negative error)

Signs of bad behavior - detecting signs Information handling systems in unusual and unsafe acts (system-based attacks) are often used in real-time intrusion detection systems (because of the complexity in computing Their math is not high. Signs of bad behavior are divided into two categories:

• Attack signs - they describe active patterns that can pose a security threat. Typically, they are expressed when a time-dependent relationship between a series of activities can be combined with neutral activities.
• Text strings are selected - markers matching text strings are looking for suspicious activity.

Any unclear activity may be considered and prevented. Therefore, their accuracy is very high (low false alarm number). However, they do not perform completely and do not completely prevent new attacks. There are two main methods that combine the detection of this signal:

• Examining problems in lower layer packages - many types of attacks exploit vulnerabilities in IP, TCP, UDP or ICMP packets. With a simple test of a set of flags on a featured package it is possible to detect which packages are valid, which ones are not. The difficulty here may be to open the package and assemble them. Similarly, some other problems may be related to the TCP / IP layer of the system being protected. Often an attacker uses a way to open packages to bypass many IDS tools.
• Test application layer protocols - many types of attacks (WinNuke) exploit program vulnerabilities, As an example,, special data sent to an established network connection. To effectively detect such attacks, IDS must be added to many application layer protocols.

Sign detection methods have some advantages: low false alarm rate, simple algorithm, easy to create attack sign database, easy addition and resource efficiency. Minimum system. Some disadvantages

• Difficulty in upgrading new types of attacks.
• They cannot inherit to detect new and unknown attacks. Must upgrade an attack signature database associated with it.
• The management and maintenance of an IDS is required in combination with the analysis and patching of security vulnerabilities, which is a time-consuming process.
• Knowledge of attack depends on the operating environment - therefore, IDS based on bad behavior must be configured to comply with its strict rules with the operating system (version, platform, applications used,.)
• They seem to be difficult to manage internal attacks. Typically, abuse of authenticated user rights cannot be detected when there is malicious code activity (because they lack information about user rights and the structure of the attack signal).

Commercial IDS products often use sign detection methods for two reasons. First, it is easier to provide known attack-related signs and to assign names to an attack. Second, the attack signature database is upgraded regularly (by adding new attack detection signs). the example below shows an attack mark taken from the Snort program, which detects ICMP ping packets larger than 800 bytes coming from an external network and combined with any port: alert icmp $ EXTERNAL_NET any -> $ HOME_NET any (msg: "MISC large ICMP"; dsize:> 800; reference: arachnids, 246; classtype: bad-unknown; sid: 499;) Correlation of parameter patterns The third method of intrusion detection is more wise than the previous two methods. It was born due to the fact that administrators check different systems and network attributes (no need to target security issues). Information obtained in this way has a specific environment that is unchanged. This method involves using the daily operating experience of administrators as the basics for detecting abnormal signs. It can be seen as a special case of the usual Profile method. The difference here is that in fact, a profile is a part of human knowledge. This is a powerful technique, because it allows intrusion based on unknown attacks. System operation can detect subtle changes that are not obvious to the activity itself. It inherits the disadvantages in the fact that people only understand a limited portion of information at a time, which means that certain attacks can pass without being detected. Data processing techniques are used in intrusion detection systems Depending on the type of method used for intrusion detection, different processing mechanisms (techniques) are also used for data for an IDS. Here are some briefly described systems: - Expert system , this system works on a set of predefined rules to describe attacks. All security-related events are combined into audits and translated as if-then-else rules. Take As an example, Wisdom & Sense and ComputerWatch (developed at AT&T). - Phân tích d?u hi?u - Ph??ng pháp Colored Petri Nets - Phân tích tr?ng thái phiên , m?t t?n công ???c miêu t? b?ng m?t t?p các m?c tiêu và phiên c?n ???c th?c hi?n b?i m?t k? xâm nh?p ?? gây t?n h?i h? th?ng. Các phiên ???c trình bày trong s? ?? tr?ng thái phiên. - Ph??ng pháp phân tích th?ng kê - Neural Networks - Phân bi?t ý ??nh ng??i dùng - Computer immunology Analogies - Machine learning - Vi?c t?i thi?u hóa d? li?u