WIRE AND WIRELESS NETWORKS
MEDIA AND INTRODUCTION TO
NETWORK SECURITY
CONTENTS
Examples of Intrusions
 IDS
 IDS types
 IDS placements

EXAMPLES OF INTRUSIONS










Performing a remote root compromise of an e-mail server
Defacing a Web server
Guessing and cracking passwords
Copying a database containing credit card numbers
Viewing sensitive data, including payroll records and medical
information, without authorization
Running a packet sniffer on a workstation to capture
usernames and passwords
Using a permission error on an anonymous FTP server to
distribute pirated software and music files
Dialling into an unsecured modem and gaining internal
network access
Posing as an executive, calling the help desk, resetting the
executive’s e-mail password, and learning the new password
Using an unattended, logged-in workstation without
permission
INTRUSION DETECTION SYSTEM (IDS)
1.
2.
IDS is a system designed to analyse and test
network system traffic and events against a set
of parameters and alert/capture data when
these thresholds are met.
IDS is a system designed to test network events
against a given set of parameters and alerts
when the thresholds are met
EFFECTIVE IDS CAPABILITIES
IDS:
 must deal with intrusions by raising alerts or
activating applications that deal with the
intrusion
 Run for a long time with human interaction
 Monitor itself and resist local intrusions
 Distinguish abnormal behaviour from normal
behaviour
 Withstand attack and continue to function
EFFECTIVE IDS CHARACTERISTICS
Scalable – capability to function in large
networks
 Low false positive rate
 Low false negatives
 Allow some anomalous behaviour without raising
unnecessary alerts

IDS OPERATION
ANALYSIS ENGINE
Brains of the IDS
 Responsible for detecting intrusions

Table
11.1
Measures
That
May
Be
Used
For
Intrusion
Detection
(This table can be found on
page 348 in the textbook.)
TYPES OF IDS
Anomaly based / heuristic based
 Signature based
 Policy Based

ANOMALY DETECTION

Statistical anomaly detection
Involves the collection of data relating to the behavior
of legitimate users over a period of time
 Then statistical tests are applied to observed behavior
to determine whether that behavior is not legitimate
user behavior
 Threshold detection



This approach involves defining thresholds, independent of
user, for the frequency of occurrence of various events
Profile based

A profile of the activity of each user is developed and used to
detect changes in the behavior of individual accounts
STATISTICAL ANOMALY DETECTION

Threshold detection
Involves counting the
number of occurrences of
a specific event type over
an interval of time
 If the count surpasses
what is considered a
reasonable number that
one might expect to
occur, then intrusion is
assumed
 By itself is a crude and
ineffective detector of
even moderately
sophisticated attacks


Profile-based
Focuses on
characterizing the past
behavior of individual
users or related groups
of users and then
detecting significant
deviations
 A profile may consist of a
set of parameters, so
that deviation on just a
single parameter may
not be sufficient in itself
to signal an alert

ANOMALY DETECTION
Rule-Based Intrusion Detection
 Techniques detect intrusion by observing events in the
system and applying a set of rules that lead to a
decision regarding whether a given pattern of activity
is or is not suspicious
 Rule-based anomaly detection
Is similar in terms of its approach and strengths to
statistical anomaly detection
 Historical audit records are analyzed to identify usage
patterns and to automatically generate rules that describe
those patterns
 Current behavior is then observed, and each transaction is
matched against the set of rules to determine if it conforms
to any historically observed pattern of behavior
 In order for this approach to be effective, a rather large
database of rules will be needed

ANOMALY BASED IDS
Advantages
 Identifies new attacks
 Minmum
maintenance – once
system is installed it
learns new patterns
on its own
 It gets better with
time
Disadvantages
 Many false positives
 Does not detect
mailicious activities
that appear ‘normal’
SIGNATURE BASED IDS
Works like a virus Scanner
 Network information is scanned against known
attack malware signatures/patterns database

SIGNATURE BASED IDS
Advantages
 Very accurate
 Low false positives
 Fast because of low
processing overhead
Disadvantages
 Cannot detect new
attacks
 Must be updated
every time there is a
new attack
IDS PLACEMENT
Network based IDS (NIDS)
 Host based IDS (HIDS)

HIDS
Monitor activity of local host (network traffic,
files , processes, etc)
 Deployed on - key servers that contain critical
information, Webservers, workstations, etc
 Host OS or application logs audit information
 Audit is analysed to detect intrusions

NIDS
Identify intrusions by looking for attack
signatures in network traffic
 Deployed per network segment
 Deployed, just outside firewall, just inside
firewall, between business units, behind remote
server, etc

QUESTIONS