Intrusion Detection System, Components, Types, Positioning of sensors, Protecting the IDS, Snort, Modes of Snort, Components of Snort, Basic Analysis and Security Engine (BASE), Wireshark, Writing Snort rules

1. Network IntrusionNetwork Intrusion
Detection System UsingDetection System Using
SnortSnort
By-By-
Disha BediDisha Bedi

2. IntroductionIntroduction
 In my project I developed a rule based network intrusionIn my project I developed a rule based network intrusion
detection system using Snort.detection system using Snort.
 BASE is used as the output module and Wireshark isBASE is used as the output module and Wireshark is
used as a packet analyzer to modify our rules from timeused as a packet analyzer to modify our rules from time
to time.to time.
 A combination of Snort and BASE makes it possible toA combination of Snort and BASE makes it possible to
log the intrusion detection data into a database and thenlog the intrusion detection data into a database and then
view and analyze it later, using a web interface.view and analyze it later, using a web interface.
 The goal of this project is to implement network securityThe goal of this project is to implement network security
to a product of Siemens,to a product of Siemens, SPPA-T3000SPPA-T3000, which is the, which is the
instrumentation and control system that provides remoteinstrumentation and control system that provides remote
access to power plant management systems.access to power plant management systems.

3. Intrusion Detection SystemIntrusion Detection System
(IDS)(IDS)
 Intrusion detectionIntrusion detection is a set of techniques and methodsis a set of techniques and methods
that are used to detect suspicious activity both at thethat are used to detect suspicious activity both at the
network and host level.network and host level.
 Intruders have signatures that can be detected. BasedIntruders have signatures that can be detected. Based
upon a set of signatures and rules, the intrusionupon a set of signatures and rules, the intrusion
detection system (IDS) is able to find and logdetection system (IDS) is able to find and log
suspicious activity and generate alerts.suspicious activity and generate alerts.
 Usually an intrusion detection system captures a packetUsually an intrusion detection system captures a packet
from the network, applies rules to its data and detectsfrom the network, applies rules to its data and detects
anomalies in it.anomalies in it.

4. Components of IDSComponents of IDS
 SensorsSensors are placed to listen to various activities in aare placed to listen to various activities in a
network or system.network or system.
 ConsoleConsole monitors events and alerts.monitors events and alerts.
 EngineEngine generates alerts if there is a suspiciousgenerates alerts if there is a suspicious
activity in the monitored eventsactivity in the monitored events..

5. Types of IDSTypes of IDS
There are two types of IDS based on the choice of sensorThere are two types of IDS based on the choice of sensor
position-position-
 Host Intrusion Detection Systems (HIDS):Host Intrusion Detection Systems (HIDS):
A host based intrusion detection system (HIDS) monitorsA host based intrusion detection system (HIDS) monitors
internal components of a computer.internal components of a computer.
 Network Intrusion Detection Systems (NIDS):Network Intrusion Detection Systems (NIDS):
Network based intrusion detection systems (NIDS) analyzesNetwork based intrusion detection systems (NIDS) analyzes
network packets captured by one or more sensors, which arenetwork packets captured by one or more sensors, which are
located in the network.located in the network.

6. There are two types of IDS based on the choice ofThere are two types of IDS based on the choice of
detection enginedetection engine--
 Anomaly DetectionAnomaly Detection
An anomaly based detection engine can trace deviationsAn anomaly based detection engine can trace deviations
from the normal state of a system, which is possiblyfrom the normal state of a system, which is possibly
caused by an attack to the system.caused by an attack to the system.
 Signature DetectionSignature Detection
Signature based intrusion detection engines try to detectSignature based intrusion detection engines try to detect
an attack from its fingerprints.an attack from its fingerprints.

7. Positioning of sensorsPositioning of sensors
 Behind the firewall:Behind the firewall:
IDS will not be able to detect every attack becauseIDS will not be able to detect every attack because
some parts of the packets belonging to the attack willsome parts of the packets belonging to the attack will
be blocked by the firewall, thus IDS is unable to detectbe blocked by the firewall, thus IDS is unable to detect
the signature of the attack.the signature of the attack.

8.  In front of the firewall:In front of the firewall:
IDS will monitor all attacks coming from the outside.IDS will monitor all attacks coming from the outside.
Thus it is able to detect signatures of the attacks.Thus it is able to detect signatures of the attacks.

9. Protecting the IDS itselfProtecting the IDS itself
One major issue is how to protect the system on which yourOne major issue is how to protect the system on which your
intrusion detection software is running. If security of theintrusion detection software is running. If security of the
IDS is compromised, you may start getting false alarms orIDS is compromised, you may start getting false alarms or
no alarms at all. The intruder may disable IDS beforeno alarms at all. The intruder may disable IDS before
actually performing any attack.actually performing any attack.
There are 2 ways of protecting the IDS:There are 2 ways of protecting the IDS:
 Snort on Stealth Interface:Snort on Stealth Interface:
Only listens to the incoming traffic but does not send anyOnly listens to the incoming traffic but does not send any
data packets out.data packets out.
 Snort with no IP Address Interface:Snort with no IP Address Interface:
When the IDS host doesn’t have an IP address itself,When the IDS host doesn’t have an IP address itself,
nobody can access it.nobody can access it.

10. SnortSnort
 Snort is primarily a rule-based IDS. It has the ability toSnort is primarily a rule-based IDS. It has the ability to
perform real-time traffic analysis and packet logging onperform real-time traffic analysis and packet logging on
Internet Protocol (IP) networks.Internet Protocol (IP) networks.
 Snort reads the rules at the start-up time and buildsSnort reads the rules at the start-up time and builds
internal data structures or chains to apply these rules tointernal data structures or chains to apply these rules to
captured data.captured data.
 Snort comes with a rich set of pre-defined rules toSnort comes with a rich set of pre-defined rules to
detect intrusion activity and you are free to add yourdetect intrusion activity and you are free to add your
own rules at will.own rules at will.

11. Modes of SnortModes of Snort
Snort can be configured to run in three modes-Snort can be configured to run in three modes-
 Sniffer modeSniffer mode, which simply reads the packets off of, which simply reads the packets off of
the network and displays them on the screen.the network and displays them on the screen.
 Packet Logger modePacket Logger mode, which logs the packets to disk., which logs the packets to disk.
 Network Intrusion Detection System (NIDS)Network Intrusion Detection System (NIDS)
modemode, which allows Snort to analyze network traffic, which allows Snort to analyze network traffic
for matches against a user-defined rule set andfor matches against a user-defined rule set and
performs several actions based upon what it sees.performs several actions based upon what it sees.

12. Components of SnortComponents of Snort
 Packet DecoderPacket Decoder:: Prepares packets for processing.Prepares packets for processing.
 Preprocessors or Input PluginsPreprocessors or Input Plugins:: Used to detectUsed to detect
anomalies, packet defragmentation and reassembly.anomalies, packet defragmentation and reassembly.
 Detection EngineDetection Engine:: Applies rules to packets.Applies rules to packets.
 Logging and Alerting SystemLogging and Alerting System:: Generates alert andGenerates alert and
log messages.log messages.
 Output ModulesOutput Modules:: Process alerts and logs andProcess alerts and logs and
generate final output.generate final output.

13. Flow of packetsFlow of packets

14. Basic Analysis and SecurityBasic Analysis and Security
Engine (BASE)Engine (BASE)
 BASE is the output module used in our IDS.BASE is the output module used in our IDS.
 This application provides a web front-end to query andThis application provides a web front-end to query and
analyze the alerts coming from a Snort IDS system.analyze the alerts coming from a Snort IDS system.
 It is written in PHP.It is written in PHP.

15. WiresharkWireshark
 Wireshark is a network packet analyzer.Wireshark is a network packet analyzer.
 A network packet analyzer will try to captureA network packet analyzer will try to capture
network packets and tries to display that packetnetwork packets and tries to display that packet
data as detailed as possible.data as detailed as possible.

16. Writing Snort rulesWriting Snort rules
All Snort rules have two logical parts:All Snort rules have two logical parts:
rule header and rule options.rule header and rule options.
 TheThe rule headerrule header contains information about what action acontains information about what action a
rule takes. It also contains criteria for matching a rule againstrule takes. It also contains criteria for matching a rule against
data packets.data packets.
The general structure of a Snort rule header:The general structure of a Snort rule header:
 TheThe rule optionsrule options part usually contains an alert message andpart usually contains an alert message and
information about which part of the packet should be used toinformation about which part of the packet should be used to
generate the alert message. The options part containsgenerate the alert message. The options part contains
additional criteria for matching a rule against data packets.additional criteria for matching a rule against data packets.

17. Use of VariablesUse of Variables
Three types of variables may be defined in Snort:Three types of variables may be defined in Snort:
•• var • portvar • ipvarvar • portvar • ipvar
 Defining variables:Defining variables:
var RULES_PATH /snort/rules/var RULES_PATH /snort/rules/
portvar MY_PORTS [22,80,1024:1050]portvar MY_PORTS [22,80,1024:1050]
ipvar MY_NET [192.168.1.0/24,10.1.1.0/24]ipvar MY_NET [192.168.1.0/24,10.1.1.0/24]
 Implementing variables:Implementing variables:
alert tcp any any -> $MY_NET $MY_PORTS ( msg:"SYNalert tcp any any -> $MY_NET $MY_PORTS ( msg:"SYN
packet";)packet";)
include $RULE_PATH/example.ruleinclude $RULE_PATH/example.rule

18. Design and implementationDesign and implementation
Position of NIDS sensors:Position of NIDS sensors:
 As our NIDS is Snort based which uses rules (orAs our NIDS is Snort based which uses rules (or
signatures) to detect an intrusion, so it should be able tosignatures) to detect an intrusion, so it should be able to
match the conditions mentioned in the rules to thematch the conditions mentioned in the rules to the
signature of the intrusion.signature of the intrusion.
 Thus we place the sensor in front of the firewallThus we place the sensor in front of the firewall
because if we place it behind the firewall, firewall willbecause if we place it behind the firewall, firewall will
block some unwanted or harmful parts of the packetblock some unwanted or harmful parts of the packet
and our snort based IDS will not be able to detectand our snort based IDS will not be able to detect
signature of the attack.signature of the attack.

19.  Setup:Setup:
Firewall
(192.168.2.34 )
Switch in DMZ
(172.18.21.10)
Switch in internal system
(192.168.2.138)
System to control
Switch in DMZ
Terminal server
(Workbench)
(172.18.21.2)
Internal thin
clients
System to control
Internal switch
Application
server
NIDS
(192.168.2.39)
Internet
Internal NetworkDMZ

20. Work done:Work done:
 Install, configure and start snort as well as MySql, BASE,Install, configure and start snort as well as MySql, BASE,
barnyard etc.barnyard etc.
 Create three different files in /etc/snort/variables .Create three different files in /etc/snort/variables .
Declare variables for device ip address, network addressesDeclare variables for device ip address, network addresses
and ports for different protocols in the three files andand ports for different protocols in the three files and
include these files in the snort configuration file.include these files in the snort configuration file.
 Create different files in /etc/snort/rules that will containCreate different files in /etc/snort/rules that will contain
rules for different protocols. Include the path of these filerules for different protocols. Include the path of these file
in the snort configuration file.in the snort configuration file.
 Also, include a file for the generic rules, which are writtenAlso, include a file for the generic rules, which are written
to show alerts for all kinds of incoming packets, wantedto show alerts for all kinds of incoming packets, wanted
and unwanted.and unwanted.

21.  Now create an ssh from your terminal to the NIDSNow create an ssh from your terminal to the NIDS
machine.machine.
 Start snort using “sudo /etc/init.d/snortbarn start”. TheStart snort using “sudo /etc/init.d/snortbarn start”. The
snort should show alerts for unwanted packets in BASE.snort should show alerts for unwanted packets in BASE.
 Using wireshark, we first check if the packets have the sameUsing wireshark, we first check if the packets have the same
content as the content mentioned in our rules. If thecontent as the content mentioned in our rules. If the
content is same, then snort should raise alert for these rulescontent is same, then snort should raise alert for these rules
in BASE. Otherwise, if the contents are not same, the rulesin BASE. Otherwise, if the contents are not same, the rules
are updated with respect to the new content of the packet.are updated with respect to the new content of the packet.

22. ResultResult
 When we start snort and run different protocols such asWhen we start snort and run different protocols such as
ssh, rdp, rmi etc, BASE shows new alerts.ssh, rdp, rmi etc, BASE shows new alerts.
 Only the generic rules in our rule set show alerts. TheseOnly the generic rules in our rule set show alerts. These
are the alerts for the unwanted packets or intrusions in theare the alerts for the unwanted packets or intrusions in the
network.network.
 In BASE we can filter the alerts on the basis of variousIn BASE we can filter the alerts on the basis of various
parameters and then try finding out a solution to preventparameters and then try finding out a solution to prevent
these intrusions in the network in the future.these intrusions in the network in the future.