INTRUSION DETECTION AND PREVENTION SYSTEMS

A general trend in industry is a shift from Intrusion Detection Systems to Intrusion Prevention Systems. In this project, we investigate the motivations behind this trend. In addition, we survey some of the available IDS/IPS tools. More specifically, we installed SNORT, “the de facto standard for intrusion detection/prevention”, and launched several attacks to see how well snort was able to log malicious behavior. Introduction The common sentiment in industry is that Intrusion Detection Systems (IDS) will be obsolete (if they aren't already) very soon. In it's place is something much more capable, an Intrusion Prevention System (IPS). IPSs are not a new technology, they are simply an evolved version of IDS supplanted by firewalls and network layer filtering to provide a more active filtering of malicious content. Our goal is to understand both IDS and IPS systems, the evolution from IDS to IPS in industry, as well as experiment with today's most common, open source IDS, Snort. Intrusion Detection Systems An Intrusion Detection System, IDS, is designed to detect unwanted attacks on systems. IDSs are the computer network equivalent to home security systems. The primary responsibility of an IDS is to detect unwanted and malicious network traffic. There are many different ways this can be done, as well as many different programs which offer this functionality. There are two main types of ID systems ID systems which operate on a host are called host-based ID systems (HIDS), and ID systems which operate on network data flow are called network-based ID systems (NIDS). The focus of our reserch was primarily on NIDS. Network Based IDS An NIDS, such as Snort, generally consists of one or more network based sensors which monitor and filter all network traffic. A sensor is generally just a network interface that has been set to promiscuous mode to sniff all the traffic going though the network. The sensors filter network traffic and generate alerts when suspicious or malicious traffic has been detected. There are two main types of detection techniques: signature matching, and statistical anomaly detection. Signature filters (such as what Snort uses) is the most widespread type of filter. A signature detection filter simply looks at the signature of the data flow which the filter monitors. In general, a signature will be a pattern of bits which can be found in a network packet. If the signature matches any of some predefined set of signatures, the filter will generate an alert. This technique is very simple to implement. However, its main drawback is that one must already know the signatures of malicious packets in order to detect them. This requires an additional amount of overhead to continually update the system with the most current malicious signatures. In addition, the attacker can slightly modify the attack in order to avoid matching the pre-existing signature rules for the original attack. The alternative approach is to use a statistical anomaly filter. Statistical anomaly filters are meant to monitor a system and detect if something abnomal occurs. The normal behavior of a system is determined under normal, safe operating conditions, and then “exceptional” events are identified. When the systems behavior deviates far from the “normal” behavior, alerts are generated. For instance, one way to determine normal behavior would be to monitor users network usage. If it is later perceived that a user is using much more bandwidth than previous measurements, this might be a signal that something abnormal is happening. The major problem with this is that systems' behaviors change with time. As a result, the system's behavior will deviate more and more from the “normal” reference model initially determined. As a result, there is a need for the reference model to evolve. However, if the reference model is updated too often, an attacker could spread out the attack over a longer period of time and possibly go unnoticed in the system. The reference model will learn the attackers behavior and incorporate that into the reference model. Host-Based IDS Though we didn't focus our survey on HIDS, we did read enough to give a general description as to how they differ from NIDS. As NIDS inspect all network traffic, HIDS inspect and detect abnormal behavior within a host. As an example, HIDS may monitor which program accesses which resources and might trigger an alert when a program abnormally starts draining system resources or modifying the /etc/passwd file. A HIDS can also monitor the state of the system and make sure everything makes sense, which is very analogous to the statistical anomaly filter. The central principle behind the effectiveness of HIDS is that attackers generally leave a trace of their activities. For instance, they might install software on a computer they have taken over. In general, a HIDS will maintain a database of system objects it should monitor. The database contains important information about these system objects attributes, modification time, size, etc. In addition, the database may contain a checksum or hash of the system objects. These objects will later be used for comparison to the current system objects. If at some point an object becomes inconsistent, the system can generate an alert. However, the attacker may somehow be able to gain access to the database. As a result, simply matching a hash doesn't guarantee that an intruder has not tampered with the file in question. For files which are very dynamic, this checksum technique will not be effective. There are many other techniques available, however our focus on HIDS ends here. Intrusion Prevention Systems Intrusion Detection Systems (IDS) are products designed to detect unwanted accesses or manipulations of a system [9]. However, they typically do not prevent or protect from attacks. IDS systems are also the oldest systems available. On the contrary, the purpose of an Intrusion Prevention System (IPS) is to not only detect that an attack is occurring, but also to stop it. To do so, it can be considered to be an advanced combination of a firewall and an IDS. To illustrate this, we first consider what a firewall does. The idea behind firewalls comes from their use in building construction to prevent the spread of fires [7, 13]. In a networking sense, they perform a similar function. Instead of preventing fire from spreading from one building to another, they prevent certain network traffic from traveling from one network section to another (or in an organization, usually from the outside network to the internal network). It typically does this by examining portions of the IP packets (including source and destination IP addresses and port numbers) and decides whether or not to let the packet pass [5, 9, 13]. Firewalls can work in both directions, preventing traffic both into and out of a network. A firewall can be considered a very simple type of IPS in that it operates using IP addresses and ports and other header information, but it does not look into the contents of the packet [10, 13]. An IPS is more advanced in that it can use application-layer information to attempt to determine intent of the packet. As mentioned, it combines the power of filtering that a firewall has, with the power of detection like an IDS has, along with the ability to prevent attacks. For these reasons IPSs are considered to be among the promising of network technologies [17]. Similar to IDSs, IPS can be divided into several types. Also like IDSs, these include Network Based IPS (NIPS) and Host Based IPS (HIPS). The distinction is very similar to that of IDSs and so will not be discussed further. IDS vs. IPS Recent trends in industry show that more and more companies are choosing IPS based solutions over IDS based solutions, primarily due to the need to actively block worm and hacker attacks, instead of passively monitoring them as an IDS system would do [11]. Although legitimate traffic is often blocked just as malicious traffic is, most system administrators believe that the benefits certainly outweigh the downsides, especially when considering the significant damage that a successful worm or hacker can have on an organization [11]. It should be noted that the blocking of legitimate traffic is not a unique problem in IPS systems. This problem occurs in any type of system that blocks traffic, including firewalls. The ability to determine with 100% accuracy whether a packet is malicious or not is simply not possible. For this reason, any security implementation will suffer from false positives. However, a system administrator must weigh the benefits of blocking good traffic (false positive) versus allowing some bad traffic (false negatives) to determine how strictly to check data.