Just under contruction, version 0.3, last update 2003/07/22

Contents

What is an Intrusion Detection System?

The aim of an IDS (Intrusion Detection System) is to detect activities that might compromise the integrity, the availability, and the privacy of ressources like computers, data etc. Network IDS (NIDS) is a technology that is works centralized and is network based. Good network intrusion detection system can have an enormous positive impact on the overall security. Although network intrusion detection systems are designed to examine network traffic to identify threats by detecting probes, scans, and attacks, it does not interfere with traffic in any way, unlike firewalls, router etc. do.

An IDS has three main components:

• data collection,
• data analysis, and
• data (and result) visualization.

For the success of an IDS the source of the data to be analyzed for intrusion signatures is very important. There are three main sources available:

• audit data like the one from syslog (staus information and messages of various components),
• share of ressources given away by the operation sytem (cpu state, number of active network connections etc.)
• the amount of network traffic (by ip, port, protocol etc.).

The process of detection by the means of data analysis can be based on different techniques: misuse detection and anomaly detection.

Misuse detection tries to identify typical patterns for known attacks in the audit data. Preconditions for this technique are the knowlegde about what the attack is based on and to make this knowlegde available and interpretable for the IDS.

In contrast, anomaly detection is based on the idea, that an attack results in an atypical system behaviour, by which it can be identified. Therefore it is necessary to define a normal system behaviour. Such systems treat special sequences of events as typical. If the IDS watches the beginning of such a sequence of events, then it expects, that the following events occure as defined by the sequence. If this is not the case, the system behaviour will be valued as abnormal.

Of the same importance is the user friendly presentation of the results of the IDS. It may be important for the user to assign a level of importance to every attack (positive). In general, a userfriendly presentation of results means, that results are displayed graphically and that summaries are generated automatically in order to present the most important things at the first view. It is also important to send an alarm to the security operator (for example by pager, email, via a message over the local network etc.).

An attack over the local network can be based on several, non exclusive, system vulnerabilities:

• missconfiguration,
• implementation errors,
• design errors in the communication protocol,
• design errors in the service specification,
• design errors in the application,
• user handling errors,
• other.

In addition to a list of attacks, based on system vulnerabilities, we can make a list of categories of possible (nonexclusive) damages:

• the attacker collects information about the target: normally the first phase of an attack (maily portscans),
• the compromise of network ressources (firewalls, router etc.): needed to get packages into the local network,
• the compromise of server ressources: e.g the ftp server,
• loss of availability: e.g. Denial-of-Service attacks (services are temporarily unavailable),
• loss of data integrity during transport: modification of checksums etc.,
• loss of data reliability during transport: e.g. sniffing,
• loss of data integrity on a computer: modification of data on a computer,
• loss of data secrecy on a computer: an attacker can read the data on your computer,
• loss of source integrity: source of data faked, e.g. email-spoofing,

Signatures

In the case of misuse detection, so called network intrusion detection signatures are of importance. It is a pattern, an NIDS is looking for in the network traffic. If a signature for an attack is matched, an alert is generated. Many signatures are protocol specific and therefore quite complicated, because it can be a precondition to reasseble the data stream before testing for the occurence of the signature.

Using signatures is always a trade off between false negatives and false positives. The more specific a signature is, the more likely it will match a paticular attack. On the other hand it might fail to identify an attack, if the attack is slightly changed (false negatives). If the signature is more general, then it might be able to detect even new or slightly changed attacks. But is might also classify normal activity as attacks (false positives).

The Need for Intrusion Detection

Without intrusion detection you are unaware of many attacks that occur. You will never know about an attack that does not damage your host (only extraction of information). And you will nerver have the information you need, if you have detected an attack, to stop it from happening again. Therefore intrusion detection might be beneficial for you.

You can place an IDS in front of and behind a firewall. In the first scenario the IDS is useful to evaluate the quality and quantity of attacks against your site (the firewall filters a lot of attack attemps). Only with this information you can have a clue about what is going on in order to secure your network.

An IDS behind a firewall can help to detect attacks from inside. It can also detect unauthorized installed server software, and evaluate the correctnes of your firewall policy. But the ideal is to use ids for all network segments, but at least for the ones containing the most important ressources.

To answer the question whether an IDS is necessary for your site, you have to value the following points:

• Has the situation/environment changed in a way, that I can say: "I need an IDS"? How can the potential dangers be evaluated? Who is threating us and from where? What could be the aim of a potential attack?
• The costs of installing and maintaining and IDS: How high are the costs, if a hacker gets access to internal ressources like data? Connected to this problem is the violation of secrecy, availability, integrity, and further legal consequences.
• The use of an IDS: Control of the network traffic to avoid and/or detect incidents, the reevaluation of the efficiency and consistency of firewall policies, the continous investigation of traffic to server, where a security update is not possible.

Flexible Responses

Flexible response is a common feature of Network IDS. It is a technique to react on a positive (a possible attack) automatically in a pre defined way. This reaction must be close in time to the attack (nearly in real time) and should abort the attack somehow or start a counter attack.

Why are automatic responses in the case of a possible intrusion detection problematic? First you have to be shure about that

• the computer that is used for the attack in not only a jumppoint,
• the computer that is used for the attack has not spoofed it's ip adress, and
• a response-attack is justified (self justice effect).

In case of a possible attack your intrusion detection system (IDS) can react via the intrusion response system (IRS). The IRS can try to secure your network and services from the attacker by:

• closing the relevant udp/tcp ports (for example sending crafted RST-packets ),
• terminatingrograms and services,
• deniing ip-datagrams from the attacking ip.-adress fireall,
• and if the attack is from internal source by closing the user account.

Some possible problems are:

• If an attacker is spoofing his ipadress you will close out an innocent user by a updating the deny/drop rules of the firewall.
• If an attacker is connecting via a proxy server, then you will drop the packages of all other people using this proxy.
• If your IDS is not configured properly, then you can kick out your self by automatic update of firewall rules.
• If your system terminates programss and services an atacker can easily use this for dos-attacks.
• Because IDS will never identify attacks in realtime and will never be able to react on an attack in realtime, attackers may crash services or install backdoors before an IDS can do something against it.
• These things become even worse in case of false positives.

If you look at these points you will see, that IDS will always be a detection system, not a reaction system. The only way to solve all these problems is to implement intrusion detection and reaction on a router. The router will forward packages it receives only after it has analysed these packages and confirmed that they are free of known attack signatures.

Links:

• Michael Sobirey's Intrusion Detection Systems Page is a page that lists over 90 host- and network based Intrusion Detection (& Response) Systems.
• Snort is the most popular, widespread, and powerful Open Source Network based Intrusion Detection System. Check it out.
• AIDE (Advanced Intrusion Detection Environment) is a Host based Intrusion Detection System that is a free replacement for the well known tripwire.
• In the category IDS Tools on whitehats you will find a list of programs ranging from sniffer over NIDS to event logging programs.
• In the linuxjournal you will find the article Paranoid Penguin: Understanding IDS for Linux, describing IDS for Linux and presenting some programs like tripwire, portsentry, snort and others.
• Securityfocus has its own IDS Section where you can find articles, news and other things about IDS issues.

back to top