Chapter 9:-INTRUSION DETECTION SYSTEM

SECURITY INTRUSION  and DETECTION

* Security Intrusion
- A security event, or combination of multiple security events, that constitutes a security incident in which an intruder gains, or attempts to gain, access to a system (or system resource) without having authorization to do.
* Intrusion Detection
- A security service that monitors and analyzes system events for the purpose of finding, and providing real-time or near real-time warning of attempts to access system resources in an unauthorized manner.


TYPES OF IDS
a)Host Based IDS (HIDS)

* Specialized software to monitor system activity to
* Detect suspicious behavior
- Primary purpose is to detect intrusions, log suspicious
- Events, and send alerts
- Can detect both external and internal intrusions
* Two approaches, often used in combination:
- Anomaly detection - defines normal/expected behavior
-- Threshold detection
--Profile based
- Signature detection - defines proper behavior
b)Network Based IDS (NIDS)

* Monitor traffic at selected points on a network
* In (near) real time to detect intrusion patterns
* May examine network, transport and/or application level protocol activity directed toward systems
* Comprises a number of sensors
- Inline (possibly as part of other net device)
- Passive (monitors copy of traffic)
c) Distributed Host Based IDS (DIDS)

IDS TECHNIQUES
* Signature detection
- At application, transport, network layers; unexpected application services, policy violations
* Anomaly detection
- Of denial of service attacks, scanning, worms
* When potential violation detected sensor sends an alert and logs information
- Used by analysis module to refine intrusion detection parameters and algorithms by security admin to improve protection

SNORT
Snort is an open source network intrusion prevention system (IPS) capable of performing real-time traffic analysis and packet-logging on IP networks. It can perform protocol analysis, content searching and; matching and can be used to detect a variety of attacks and probes, such as buffer overflows, stealth port scans, CGI attacks, SMB probes, OS fingerprinting attempts and more.

* Snort rules
- Use a simple, flexible rule definition language
- With fixed header and zero or more options
- Header includes: action, protocol, source IP, source port, direction, dest IP, dest port
- Many options

HONEYPOTS

* Are decoy systems
- Filled with fabricated info
- Instrumented with monitors / event loggers
- Divert and hold attacker to collect activity info
- Without exposing production systems
* Initially were single systems
* More recently are/emulate entire networks