Practical Issues with Intrusion Detection smb%c2%a0%c2%a0%c2%a0%c2%a0... · PDF file 2006. 11. 14. · Extrusion Detection Simple Logging Log Files Finding Compromised Hosts 3 / 42

Practical Issues with Intrusion
Detection
Practical Issues with Intrusion Detection Intrusion Detection — How?
Sensors
Simple Logging
Log Files
Finding Compromised Hosts
1 / 42

Intrusion Detection — How?
Practical Issues with Intrusion Detection Intrusion Detection — How?
Sensors
Simple Logging
Log Files
2 / 42
■ Where do sensors go? ■ How do you put them there? ■ Sensor issues ■ Other techniques ■ Ethical and legal issues

Sensors
Practical Issues with Intrusion Detection
Sensors
Locations
What’s Dark Space?
What’s the Purpose?
Auto-Quarantine
Honeypots and Honeynets
Host- or Net-Resident? Net-Resident: Parallel
Tapping an Ethernet
Net-Resident: Serial Host-Resident Monitor
TCP Normalization The Big Advantages of Host IDS
Extrusion Detection
Simple Logging
Log Files
3 / 42

Locations
Sensors
Locations
Auto-Quarantine
Tapping an Ethernet
Extrusion Detection
Simple Logging
Log Files
4 / 42
■ Outside the firewall? ■ We know there are bad guys there; what’s the
point? ■ Just inside? What’s the threat model? ■ On sensitive internal nets? ■ In front of each sensitive host? ■ In “dark space”?

Sensors
Locations
Auto-Quarantine
Tapping an Ethernet
Extrusion Detection
Simple Logging
Log Files
5 / 42
■ A block of address space not used by real machines and not pointed to by DNS entries
■ There is no legitimate reason to send packets to such addresses
■ Therefore, any host sending to such addresses is up to no good
■ Commonly used to detect scanning worms

Sensors
Locations
Auto-Quarantine
Tapping an Ethernet
Extrusion Detection
Simple Logging
Log Files
6 / 42
■ Unless you’re a researcher, you care about real threats to your own machines
■ Inside the firewall? Detect data exfiltration ■ Sensitive internal nets: detect threats aimed at
them ■ Watching each host? Detect attacks on inside
hosts from other hosts on the same LAN ■ Dark space? Detect scanning worms (and
attackers)

Auto-Quarantine
Sensors
Locations
Auto-Quarantine
Tapping an Ethernet
Extrusion Detection
Simple Logging
Log Files
7 / 42
■ Many organizations implement “auto-quarantine”
■ This is especially common for university residence hall networks
■ Machines that do too much scanning (and in particular attempt to probe dark space) are assumed to be virus-infected
■ They’re moved to a separate net; the only sites they can contact are Windows Update, anti-virus companies, and the like

Sensors
Locations
Auto-Quarantine
Tapping an Ethernet
Extrusion Detection
Simple Logging
Log Files
8 / 42
■ Special-purpose host or network designed to be attacked
■ Equipped with copious monitoring ■ Lure the attacker in deeper ■ Waste the attacker’s time; study the attacker’s
technique ■ Note well: keeping honeypot (and dark space)
addresses secret is vital

Host- or Net-Resident?
Sensors
Locations
Auto-Quarantine
Tapping an Ethernet
Extrusion Detection
Simple Logging
Log Files
9 / 42
■ Suppose you want to monitor each host. Where does the monitor live?
■ Dedicated in-line hardware: good, but expensive
■ On the host: cheap, but subvertible

Net-Resident: Parallel
Sensors
Locations
Auto-Quarantine
Tapping an Ethernet
Extrusion Detection
Simple Logging
Log Files
10 / 42
Network
NetworkHost
IDS
■ Very unobtrusive ■ But — need special hardware to tap an
Ethernet ■ Need some network connection to the IDS

Tapping an Ethernet
Sensors
Locations
Auto-Quarantine
Tapping an Ethernet
Extrusion Detection
Simple Logging
Log Files
11 / 42
■ Cannot simply wire IDS to jack ■ Best solution: one-way tap gear ■ Note: unidirectional only; may need a pair of
them ■ Some switches have a monitoring port (AKA
spanning port, mirroring port, etc) — can receive copies of data from any other port
■ For 10BaseT nets, use a hub instead of a switch

Net-Resident: Serial
Sensors
Locations
Auto-Quarantine
Tapping an Ethernet
Extrusion Detection
Simple Logging
Log Files
12 / 42
IDS NetworkHost
■ Can’t miss packets ■ But — if it crashes, the host is unreachable ■ More detectable, via timing ■ Can the IDS box be hacked?

Host-Resident Monitor
Sensors
Locations
Auto-Quarantine
Tapping an Ethernet
Extrusion Detection
Simple Logging
Log Files
13 / 42
NetworkHost IDS
■ No special hardware needed ■ IDS sees exactly what host sees ■ But — subvertible ■ Useful precaution: immediately transmit IDS
data elsewhere

TCP Normalization
Sensors
Locations
Auto-Quarantine
Tapping an Ethernet
Extrusion Detection
Simple Logging
Log Files
14 / 42
■ Attackers can play games with TCP/IP to confuse

Practical Issues with Intrusion Detection smb%c2%a0%c2%a0%c2%a0%c2%a0... · PDF file 2006. 11. 14. · Extrusion Detection Simple Logging Log Files Finding Compromised Hosts 3 / 42

Text of Practical Issues with Intrusion Detection smb%c2%a0%c2%a0%c2%a0%c2%a0... · PDF file...

Secure System Design: E-Commerce Web Site smb%C2%A0%C2%A0%C2%A0... · PDF file Even if they don’t, compromise of a user’s e-commerce password could permit orders billed to that

Security: The Human Element smb%c2%a0%c2%a0%c2%a0%c2%a0 · PDF file The Human Element “Humans are incapable of securely storing high-quality cryptographic keys, and they have unacceptable

Biometrics; Authentication as a Systems Problem smb%c2%a0%c2%a0% · PDF file · 2013-09-26the problmes are likely to remain difﬁcult issues for system designers? Steven M. Bellovin

Complex Access Control - cs. smb%c2%a0%c2%a0%c2%a0%c2% · PDF filehTop, Planesi and hSecret, Subsi are not comparable, Steven M. Bellovin September 14, 2010 30. Using this Scheme

Web Server-Side Security smb%c2%a0%c2%a0%c2%a0%c2%a0 · PDF file Most interesting web sites use server-side scripts: CGI, ASP, PHP, server-side include, etc. Each such script is a

Authentication - cs. smb%c2%a0%c2%a0%c2%a0%c2%a0 · PDF file password as the key (Why not encrypt the password?) + This is where the 8-character limit comes from Any decent cryptosystem

Employment and Computers - cs. smb%c2%a0%c2%a0%c2%a0... · PDF fileAlcatel “merged” with Lucent; Nokia is buying the new ... remained a monopoly—and didn’t drop in price very

Databases and the Law smb%c2%a0%c2%a0%c2%a0... · PDF file or more databases Steven M. Bellovin February 11, 2010 4. Scale • Vastly more data is in machine-readable form • A lot

Año 20 Saltillo, Coahuila 10 de junio de 2019 Número 241 ... 2028/VII.%C2%A0%C2%A0%C · PDF file Asignación de nomenclatura al Bulevar El Minero, que se ubica al nororiente de

System Structure - cs. smb%c2%a0%c2%a0%c2%a0... · PDF file The Web Server Complex Web Server Web Server Router Router Inverse Proxy/ Load Balancer Load Balancer Proxy/ Inverse Router

Protecting the Client smb%c2%a0%c2%a0%c2%a0... · PDF file If someone using the application connects to your server—or if you can trick someone into connecting to your server via

STAINES AP-PLANS PHDD C2-A0 HVAC MECH

Identity, Security, and Privacy smb%c2%a0%c2%a0%c2%a0%c2%a0%c2%a0/tal · PDF file Reputation should adhere to the real identity A bad guy should not be able to discard a bad reputation

แนวทางการบ าบัดรักษาด้วยเมทาโดนระยะยาวe-lib.ddc.moph.go.th/images/pic_book/68.%C3%A0%C2... · PDF file แนวทางการบ

Viruses, Worms, and Trojan Horses smb%C2%A0%C2%A0%C2%A0%C2%A0% · PDF file How do they spread? What can be done about them? Steven M. Bellovin February 9, 2020 2. Worms in Science

Preparing Your Google Cloud VM for W4187 smb%c2%a0%c2%a0%c2%a0%c2%a0 · PDF file 7. Select No for \Please email me updates ..." unless you actually want email updates on new o erings

Risks of Computers: What do we Do? - cs. smb%c2%a0%c2%a0%c2%a0... · PDF fileThe Bloomberg Crash ... ther traders said they depended on Bloomberg chat so heavily that they weren’t

The Cybersecurity Challenge smb%c2%a0%c2%a0%c2%a0%c2%a0... The Problem “Our first observation is that we are hard pressed to say that cyberspace is more secure than it was 35 years

c2%a0.pdfPDF file

Doing History in the Internet Age smb%c2%a0%c2%a0%c2%a0... · PDF file the Freemasons (1829), the Templars (1867), and the Ku Klux Klan (1872) Neither of these two meanings is listed

The Crypto Wars smb%c2%a0%c2%a0%c2%a0%c2%a0... The American Black Chamber The US originally did little of this, but learned rapidly during World War I (During the Civil War, the Union

Introduction to Cryptography, Part II smb%c2%a0%c2%a0%c2%a0%c2% · PDF fileHomomorphic Vs. Non-malleable •Homomorphic encryption ... •How many people need to be in a room for

Protecting the Internet Against Large-Scale Passive Monitoring smb%c2%a0%c2%a0%c2%a0%c2%a0 · PDF file Types of Attack Passive Attacker just listens Active Attacker transmits messages;

Computers, Society, and the Law smb%c2%a0%c2%a0%c2%a0%c2%a0... · PDF file 2017-04-13 · Recording Electronic) voting machines and Internet voting ... lUse machine learning to make

DISTRIBUTION ONLY smb%c2%a0%c2%a0%c2%a0%c2%a0... · PDF file 2017. 5. 29. · 3-4. mum m- ” 4..mm.mm.m . we ... In nuclearweapons that areinherently one-point safe,‘nuclearsafety

A Introduction to Modern Cryptography smb%c2%a0%c2%a0%c2%a0... on the history of cryptography. The Code Book: The Science of Secrecy from Ancient Egypt to Quantum Cryptography, Simon

Viruses, Trojan Horses, and Worms smb%c2%a0%c2%a0%c2%a0%c2%a0 · PDF file Worms in Science Fiction “Let me put it another way. You have a computer with an auto-dial phone link

Google versus China smb%c2%a0%c2%a0%c2%a0%c2% · PDF fileincluding from Chinese companies like Huawei. ... • Some of the attacks were directed at dissidents and activists ... they

Final Review - cs. smb%c2%a0%c2%a0%c2%a0%c2%a0 · PDF file Final Review The Test Conditions Format Material Limits Memory and Virtual Memory Paging File Systems Permissions Device

Frank Miller’s Codebook smb%c2%a0%c2%a0%c2%a0%c2%a0 · PDF file Lots of Google and Google books searches; ... memory of it in 1912 when he formulated his maxim? Does the evidence