ple, Network Flight Recorder (a commercial IDS) offers a feature that can send aTCPRST packet and kill a session.
The final phase is the refinement stage. This is where the fine-tuning of the IDS or IPS system can be done, based on previous usage and detected intrusions. This gives the security professional a chance to reduce false-positive levels and to have a more accurate security tool. This is a very critical stage for getting the most from your IDS or IPS system. The system must be fine-tuned for your environment to get any real value from it. There are tools, like Cisco Threat Response (CTR), that will help with the refining stage by actually making sure that an alert is valid by checking whether you are vulnerable to that attack or not.
Rule-based detection, also referred to as signature detection, pattern matching and misuse detection, is the first scheme that was used in early intrusion-detection systems. Rule-based detection uses pattern matching to detect known attack patterns.
Let’s look at how the four phases of the analysis process are applied in a rule-based detection system:
The pattern descriptors are typically either content-based signatures, which examine the payload and header of a packet, or context-based signatures that evaluate only the packet headers to identify an alert. Note that pattern descriptors can be atomic (single) or composite (multiple) descriptors. An atomic descriptor requires only one packet to be inspected to identify an alert, while a composite descriptor requires multiple packets to be inspected to identify an alert. The pattern descriptors are then put into a knowledge base that contains the criteria for analysis.
An anomaly is something that is different from the norm or that cannot be easily classified. Anomaly detection, also referred to as profile-based detection, creates a profile system that flags any events that strays from a normal pattern and passes this information on to output routines.
One key distinction between anomaly detection and other analysis schemes is that anomaly-based schemes not only define activities that are not allowed, but also activities that are allowed. In addition, anomaly detection is typically used for its ability to collect statistical behavior and characteristic behavior. Statistics are quantitative and characteristics are more qualitative. For example, “This server’s UDP traffic never exceeds 25 percent of capacity” describes a statistical behavior, and “User Stan321 does not normally FTP files outside of the company” describes a characteristic behavior.
Anomaly-based schemes fall into three main categories: behavioral, traffic pattern, and protocol. Behavioral analysis looks for anomalies in the types of behavior that have been statistically baselined, such as relationships in packets and what is being sent over a network. Traffic-pattern analysis looks for specific patterns in network traffic. Protocol analysis looks for network protocol violations or misuse based on RFC-based behavior.
Protocol analysis has the benefit of identifying possible attacks that are not yet publicized or that there is no known signature or remedy for.
Requests for Comments (RFCs) are a series of notes about aspects of the Internet, such as protocols. A document can be sent to the Internet Engineering Task Force (IETF), which is a standards organization for the Internet, and they will determine whether it becomes an RFC. See www.faqs.org/rfcs/ for more info about RFCs.
Again, let’s review the analysis model in the context of anomaly detection:
Target-monitoring systems will report whether certain target objects have been changed or modified. This is usually done through a cryptographic algorithm that computes a cryptochecksum for each target file. The IDS reports any changes, such as a file modifications or program logon, which would cause changes in cryptochecksums
Tripwire software will perform target monitoring using cryptochecksums by providing-instant notification of changes to configuration files and enabling automatic restoration. The main advantage of this 