U11.1 Intrusion detection

U11.1 Intrusion detection

1. Firewalls can only prevent attacks from external attack

   • Cant detect or prevent attacks
     • Do not react to attacks

2. IDS combats insider threats

   • Insiders with access to resources
     • Easier to exploit from inside
       • Firewalls cant protect from the insiders
         • Manual processes for detecting intruders are too complex and resource heavy, esp on a large estate

3. Automated system to monitor multiple hosts

   • for suspicious behaviour
     • reports on this behaviour

4. Knowledge based or misuse detection IDS (Most common)

   • Most IDS look for attack signatures
     • specific patterns of NW traffic or activity in log files to indicate specific behaviour
       • IE: number of failed logins, certain types of TCP SYN packets, buffer overflow
   • Uses Known vulnerabilities, known attacks on systems
   • Only as good as the information in the database of signatures
     • New Vulnerabilities not in the DB can be exploited
       • Vendors need to keep up to dat with latest attacks and issue updates
         • large DB makes IDS slow
         • Gap between exploit being discovered and attack signature update for the DB

5. Behaviour based IDS

   • Statistical anomaly detection or behaviour based detection is where statistical techniques are used to detect penetrations and attacks
     • Begin by establishing base line behaviour, what is normal
       • Then gather new data and measure the deviation
         • if threshold is exceeded, issue an alert
       • monitor number of failed logins
         • Raises the issues of false positives and false negatives where something falls within the boundary of normal behaviour
           • does also apply to knowledge based systems
           • Fine tuning required in order to get optimal setting, like biometrics
   • Not widely used