notes/docs/lectures/security/15_intrusion_detection.md

Anti-Virus

• Signature-based detection

  • Store some small code signature for each virus

  • Scan files either in bulk or at run-time, compare with the signatures on file

  • Generic signatures

  • Hashing the entire file is a bad idea, the author only needs to add a nop to completely change the signature

    • Also hashing every executable is slow

  • Instead we identify key pieces of the malware and hash that

  • 

  • This method is never going to catch a virus it’s never seen before

• Heuristics

  • Determine what actions and rules a virus program will normally adopt
  • Start the program in a VM and see what it does
  • Theoretically could detect a virus that doesn’t strictly match some signature
    • Only if it does the same thing as a virus it’s seen before
  • A lot slower than signature detection as it needs to be run in a VM before the user is allowed to open it
    • What if the virus sleeps for 20 seconds before doing anything? very hard to detect

• Machine learning

  • 

Network Attack Models

• Firewalls don’t protect against
  • Attacks using valid protocols
  • Insider attacks

Intrusion Detection Systems (IDS)

• Detects possible intrusion attempts
• Generates alerts and logs for administrators

Intrusion Prevention Systems (IPS)

• Identical to IDS except also stops the attack

IDS Deployment

• Host-based (HIDS)
  • Monitors a single host to find suspicious activity including resource / app usage
  • In many ways modern anti-virus does this
  • Additional layer of security software running on a host within a protected LAN or VPN
  • Creates a profile of usage for specific users
  • Can monitor CPU, memory use, application use and the network stack
• Network-based (NIDS)
  • Monitors network traffic and analyses packets from different protocols to identify suspicious activity
  • Placed at a viewpoint on a network to examine and analyse traffic
    • Installed on a firewall or in a DMZ
    • Installed behind a screened subnet
  • May perform deeper analysis than many firewalls
    • like stateful protocol analysis and deep packet inspection

Components of an IDS

• Sensors / Agents: collect and collate data from multiple viewpoints on a network
• Analysers: ascertain if an intrusion has taken place
• Reporting: notify the administrators via alerts on a console or graphical interface

Multiple sensors allow us to distribute capture, but centralise computing overhead

Detection Modes

• Stateful Protocol analysis
  • More complex version of a stateful packet filter
  • Hold detailed session information on protocols being used, examine for attacks
    • Why is this user logging on as root?
    • Why is this command being sent a 1000-byte buffer as a parameter (buffer overflow)
  • Computationally costly and requires the IDS to have all possible versions of these protocols defined in its database
• Signature-based
  • Fingerprinting sequences of operations or packets
  • Like antivirus, signatures are created and stored in a database - operations as well as binaries
  • If operations match a defined signature, then an alarm is triggered
  • Include some form of attack language
    • Mechanisms to describe sequences of events
    • Maintain and monitor intermediate states and event transitions
  • The pros and cons of these systems are identical to their anti-virus counterpart
    • Computationally efficient
    • Always spots known attacks
    • Always misses unknown attacks
    • Detailed signature databases must be kept up-to-date
  • Example: If there is a large amount of ICMP traffic, many TCP packets (SYN packets)
    • These connections going to a variety of other hosts
  • If a host establishes more than 3 tcp connections to different hosts in 5 seconds, it’s port scanning
• Anomaly-based

  • Build a model of normal and find deviations

  • Anomaly detection has wide-ranging application from IDS to banking fraud

  • Build up a picture of normal usage, and detect when usage moves beyond what is normal

  • Always a trade-off between false positives and false negatives

  • 

  • Run a host within a quarantined environment and collect training data

  • Constructed by monitoring audit logs

  • Sometimes rely on analysis of sequences of system calls through normal behaviour

  • 

    • However network traffic is more complex than a normal curve

  • 

    • Very hard to decide if network traffic is nefarious or not

Snort

• Snort is a powerful and well established IDS

  • Also free!

• Uses rules to analyse network packets, and then can provide alerts or logging

• Snort has built-in rules for detecting nmap; a logged scan may look like this:

  • 

  • The machine 10.0.4.1 is sending out packets with incremented port numbers

  • The time stamps on the data show the packets are being sent extremely quickly

  • All these packets are synchronised packets; it’s not waiting for ACK packets

Nmap Timings

• You can avoid detection when using nmap by reducing the speed of the scan
• This makes port scanning very hard to distinguish from general network noise
• nmap contains 6 timing options
  • paranoid mode leaves 5 minutes between packets
  • insane mode is basically a DDOS attack

Machine Learning

• Machine learning approaches train a model to make predictions on data
• Support vector machines, neural networks etc

Neural Networks for ID

• A network can be pre-trained
• Sensor measurements are then passed through the network
• Activations in the specific output neuron signal an alert

• Scales badly
  • Search space can increase exponentially
  • Real-time data
• False negatives
  • Limits in the representation
  • What is normal can change
    • Do we retrain and risk learning an intruder’s behaviour?