- Intrusion Detection Systems (IDS) are designed to detect security breaches and aid in mitigating damage caused by hacking. The basic intent is to spot something suspicious on a network or system and sound an alarm. [IDS monitor network traffic and system logs and trigger alarms for any abnormal activity.] - There are two main types of IDS: Network IDS (NIDS) which use sensors to monitor all network traffic, and Host based IDS (HIDS) which are installed on individual workstations/servers to watch for abnormal activity only on that computer. [IDS can be configured to watch for known attacks, analyze audit logs, terminate connections, and alert administrators.] - Intrusion Prevention Systems

1. IDS/IPS
TAPAN KUMAR KHILAR

2. What is an Intrusion?
An intrusion is somebody attempting to break into or
misuse your system. The word “misuse” can reflect
something severe as stealing confidential data to something
minor such as misusing your email system for spam.
Intrusion can be defined as any set of actions that attempt
to compromise the integrity, confidentiality or availability of
resource.
In the context of info systems, intrusion refers to any
unauthorized access, unauthorized attempt to access or
damage or malicious use of info resources.

3. WHO ARE INTRUDERS?
• Outsiders. Intruders from outside the
network. They may attempt to go around
the firewall to attack
internal network.
machines on the
• Insiders. Intruders that legitimately
use your internal network. These include
users who misuse privileges or who
impersonate higher privileged users.

4. HOW DO INTRUDERS GET INTO
THE SYSTEM?
• Physical intrusion.
• System intrusion.
• Remote intrusion.

5. • The main function of an IDS is to warn
about suspicious activity taking place, but
not to prevent them.
• An IDS specifically looks for suspicious
activity and events that might be the result
of a virus, worm or hacker.
WHAT IS AN INTRUSION
DETECTION SYSTEM?

6. Intrusion Detection Systems (IDS)
IDS designed to detect security breaches.
IDS designed to aid in mitigating damage caused by hacking.
Basic intent behind IDS: spot something suspicious on
NW/system and sound alarm.
May look for data bits that indicate questionable activity or
monitor system logs.
Events that sound alarm – may not be an intrusion; any
abnormal activity may trigger, depending on configuration.

7. Intrusion Detection Systems (IDS)
All IDS have three things in common:
Sensors: collect tfc and user activity data and sends to
analyzer.
Analyzer: Looks for suspicious activity.
Administrator Interface: If analyzer detects suspicious
activity, sends an alert to the Admin Interface.

8. Intrusion Detection Systems (IDS)
Why use an IDS:
To detect attacks and other security violations that are not
prevented by other security measures,
To detect and deal with the preambles to attacks (commonly
experienced as network probes and other “doorknob rattling”
activities),
To document the existing threat to an organization
To act as quality control for security design and administration,
especially of large and complex enterprises
To provide useful information about intrusions that do take
place, allowing improved diagnosis, recovery, and correction of
causative factors.

9. Intrusion Detection Systems (IDS)
IDS can be configured for:
Watch for attacks
Parse audit logs
Terminate a connection
Alert an admin as attacks are happening
Protect system files
Expose a hacker’s techniques
Throw up vulnerabilities that need to be addressed
Possibly help to track down hackers
Two main type of IDS:
NIDS
HIDS

10. Network Intrusion Detection Systems (NIDS)
Uses sensors to monitor all NW tfc
Cannot see the activities within the computer itself.

11. Host based Intrusion Detection Systems (HIDS)
Installed on indl workstns / servers
Watches for abnormal activity
NIDs understands and monitors NW
computer only on which it is installed.
tfc, HIDs monitors the
Gen, HIDS installed on critical servers only due to administrative
overheads.

12. Types of HIDS/NIDS
Signature based
Pattern matching
Stateful matching
Anomaly based
Statistical anomaly based
Protocol anomaly based
Tfc anomaly based
Rule based

13. Types of HIDS/NIDS
A pkt having the same source and destination address (Land
Attack)
A TCP header of a pkt in which all values are set to 1s (xmas
attack).
Once these type of attack discovered, vendors wrote signatures
that looks specially for pkts with same source and destination
addresses or with TCP headers flag set to all 1s.
Knowledge or Signature based IDS
Knowledge is gained by sensors about how specific attacks are
carried out.
Each identified attack has a signature
Eg of a signature:

14. Types of HIDS/NIDS
Knowledge or Signature based IDS
Most popular IDS today.
Effectiveness depends on regularly updating signature database.
May not be able to uncover new types of attacks.

15. Types of HIDS/NIDS
State based IDS
What is a state?
Every change that an OS experiences (user log on, opening of
aplns, user data input, etc), is a state transition.
Gen happens continuously in any system.
So again, what is a state?
A snapshot of an OS’s values in volatile and non-volatile memory
locations.
In a state based IDS:
Initial state is the state prior to attack execution.
Compromised state is the state after successful penetration.
The IDS has rules as to which state transitions should trigger
alarm.

16. Types of HIDS/NIDS
An example of State based IDS
•A remote user connects to a system
•Sends data to an apln (data exceeds alloted buffer for this
empty variable).
•The data is executed and overwrites the buffer and possibly
other memory segments.
•A malicious code executes.
sequence matches its preconfigured rules.
Requires frequent signature updates.
State based IDS looks for activity between initial and
compromised state and sends alert if any state transition

17. Types of HIDS/NIDS
Statistical Anomaly based IDS
A behavior based system (also called heuristic IDS).
Does not use a signature database.
Initially put in a learning mode wherein the IDS learns the `normal’
NW activities.
The longer it is in learning mode, more accurate profile of a
normal state is built up.
After a profile is built, all future activities are compared to this
`normal’ profile.
If an activity exceeds a predefined `normal’ threshold, the alert is
triggered.

18. Types of HIDS/NIDS
Statistical Anomaly based IDS - Benefits
Can react to 0 day attacks
Also capable of detecting the low and slow attacks
Statistical Anomaly based IDS – Problems
May provide overwhelming number of false positives.
If an attacker discovers an IDS on a NW, will try to detect type so
that he can circumvent it.
With a behavior based IDS, attacker will try to integrate activities
in the `normal’ NW usage.
If an attack was underway when the IDS was in learning mode,
an attack will never be detected.
Sends generic alerts compared to specific alerts thrown up by
signature based IDS.

19. Types of HIDS/NIDS
Statistical Anomaly based IDS
Strength of this IDS lies in determining actual thresholds of normal
activity.
Once an attack is iden, the IDS can:
Send an alert to the admin’s console.
Send an email to a preconfigured address.
Kill the connection of the detected attack
Reconfigure a router/firewall to stop any
attacks.
further similar

20. Types of HIDS/NIDS
Protocol Anomaly based IDS
These IDS have specific knowledge of each protocol they will
monitor.
A protocol anomaly pertains to the format and behavior of a
protocol..
The IDS builds a model of each protocol’s `normal’ usage
Eg of protocol anomaly:
Data Link Layer: ARP attack where bogus data is inserted in an
ARP table.
NW Layer: ICMP can be used in a Loki Attack to move data from
one place to another.

21. Types of HIDS/NIDS
Traffic Anomaly based IDS
Detects changes in NW tfc patterns
Tfc patterns may change during DoS attacks or when a new
service is introduced on the NW.
The IDS learns the normal tfc pattern and sets a threshold.
0 day attacks can be detected.

22. Types of HIDS/NIDS
Rule based IDS
A signature based IDS is very straightforward –
if a pkt has same source/destination address, send alert.
A statistical anomaly based IDS is also straightforward –
X logs in his system at 8 AM and logs off at 5 PM everyday. If he
logs on at 10 PM, it is an anomaly and an alert is sent.
Rule based IDS gen used in expert systems (Artificial
Intelligence).
An expert system has:
A knowledge base
An inference engine
Rule based programming.

23. Types of HIDS/NIDS
Rule based IDS
Rule based programming refers to - IF situation THEN action.
The rules are applied to facts (data that comes in from a sensor).
Rule based IDS gathers data from sensors/logs, the inference
engine uses its pre-programmed rules on it. If characteristics of
the rule is met – an alert is triggered.
Eg of a rule based IDS:
IF a root user creates file1 AND creates file2 SUCH THAT they are in the
same directory AND the root user opens tool1 TRIGGER send alert.

24. IDS
Placement of sensors
Outside the FW- detect attacks
Inside the FW – to detect actual intrusions
Highly sensitive subnets
DMZs
NW Tfc:
Every vendor’s IDS product has a threshold.
If NW tfc exceeds the threshold, all pkts may not be examined
and attacks may go unnoticed.
In high tfc environments multiple sensors reqd to be placed to
ensure all pkts are investigated.

25. • Intrusion Prevention System (IPS) is any
device (hardware or software) that has the
ability to detect attacks, both known and
unknown, and prevent the attack from being
successful.
WHAT IS IPS?

26. Intrusion Prevention Systems (IPS)
The bad guys are always one step ahead
professionals.
of the security
Security professionals try and come up with innovative means to
detect and prevent attacks.
IPS is a preventive device rather than a detective device (IDS).
An IPS combines the prevent action of a FW with the in depth
pkt analysis function of an IDS.

27. • Broadly classified into two categories
– Host IPS (HIPS)
– Network IPS (NIPS)
CLASSIFICATION OF IPS

28. • HIPS is installed directly on the system
being protected
• It binds closely with the operating system
kernel and services, it monitors and
to the kernel inintercepts system calls
order to prevent
them.
attacks as well as log
• It prevents the system from generic
attacks
exists.
for which no “signature” yet
HOST-IPS

29. • Has two network interfaces, one designated
as internal and one as external.
• Packets passed through both interfaces and
they determined whether the packet being
examined poses a threat.
If it detects a malicious packet, an alert is
raised, the packets are discarded
immediately. Legitimate packets are passed
through to the second interface and on to
their intended destination.
•
NETWORK-IPS

30. TYPES OF IPS
• Inline network intrusion protection
systems.
• Layer seven switches.
• Application firewalls.
• Hybrid switches.
• Deceptive applications.

31. INLINE NETWORK IPS
• It is configured with two NICs,
management and one for detection.
one for
• NIC that is configured for detection usually does
not have an IP address assigned .
• It works by sitting between the systems that need
to be protected and the rest of the network.
• It inspects the packet for any vulnerabilities that
it is configured to look for.

32. INLINE NETWORK IPS
PKT SCRUBBING

33. • Placing these devices in front of your
firewalls would give protection for the entire
network.
• However the drawbacks are that they can
only stop attacks that they know about.
• The only attack they can stop that
others IPS can’t are the DoS attacks.
most
LAYER SEVEN SWITCHES

34. LAYER SEVEN SWITCHES

35. • These IPSs are loaded on each server that is to be
protected.
• These types of IPSs are customizable to each
application that they are to protect.
• It profiles a system before protecting it. During the
profiling it watches the user’s interaction with the
application and the applications interaction with the
operating system to determine what legitimate
interaction looks like.
• The drawback is that when the application is updated
it might have to be profiled again so that it does not
block legitimate use.
APPLICATION FIREWALLS

36. HYBRID SWITCHES
• They inspect specific traffic
content as has been configured .
for malicious
• Hybrid switch works in similar manner to layer
seven switch, but has detailed knowledge of the
web server and the application that sits on top
of the web server.
• It also fails , if the user’s request
match any of the permitted requests.
does not

37. HYBRID SWITCHES

38. DECEPTIVE APPLICATIONS
• It watches all your network traffic and figures out
what is good traffic.
• When an attacker attempts to connect to services
that do not exist, it will send back a response to
the attacker
• The response will be “marked” with some bogus
data. When the attacker comes back again and
tries to exploit the server the IPS will see the
“marked” data and stop all traffic coming from the
attacker.

39. Honeypots
A system set up as a sacrificial lamb on a NW.
Not locked down.
Modified operational data kept on system to lure hackers to this
system rather than going to an actual operational system.
Enables admin to know what types of attacks are occurring.
May also help to track down an intruder.
More the time spent by the hacker on a honeypot, more info can
be gained about his techniques.

40. Honeypots
Legal issues with a honeypot
Enticement versus entrapment.

41. THANK YOU