approach is that you do not have to continuously monitor the target files.
Stealth probes correlate data to try to detect attacks made over a long period of time, often referred to as “low and slow” attacks. Data are collected from a variety of sources, and it is characterized and sampled to discover any correlating attacks. This technique is also referred to as wide-area correlation, and it is typically a combination or hybrid approach that uses other detection methods to try and uncover malicious behavior.
The term heuristics refers to artificial intelligence (AI). In theory, an IDS will identify anomalies to detect an intrusion, and it will then learn over time what can be considered normal. To use heuristics, an AI scripting language can apply analysis to the incoming data.
Heuristics still leave a lot to be desired at this stage, but development is progressing. What is needed is a pattern-matching language that can use programming constructs to learn and identify malicious activity more accurately.
We have examined the fundamental analysis schemes. You will find that there is much debate on which is considered the best approach. In actuality, they all have their merits and drawbacks, but when they are used together they can offer a more robust security system. Products that use a hybrid approach typically perform better, especially against complex attacks.
We have looked at the theory of IDS patterns and analysis schemes. It seems appropriate at this point to examine few IDS rules to illustrate those concepts.
The following is an IDS rule from an open source network IDS called Snort that detects whether the NetBus back door is running on a system:
alert tcp $HOME_NET 12345:12346 -> $EXTERNAL_NET any (msg:"BACKDOOR netbus active"; flow:from_server,established; content:"NetBus"; reference:arachnids,401; classtype:misc-activity; sid:109; rev:4;)
From this rule, we can see that Snort will send an alert if a TCP packet on ports 12345–12346 come through. If that happens, Snort sends the message of “BACKDOOR netbus active” and the message is given a class type of miscellaneous activity and a signature ID of 109. The signature is on its fourth revision.
The following Snort IDS signature detects a DNS zone transfer request:
alert udp $EXTERNAL_NET any -> $HOME_NET 53 (msg:"DNS zone transfer UDP"; content: "|00 00 FC|"; offset:14; reference:cve,CAN-1999-0532; reference:arachnids,212; classtype:attempted-recon; sid:1948; rev:1;)
From this signature, we can see that Snort sends an alert if a UDP packet on port 53 comes through. Snort sends the message “DNS zone transfer UDP” with a class type of attempted reconnaissance and a signature ID of 1948. This signature is on its first revision.
As stated earlier, IDS and IPS are two separate technologies that can complement each other. The following sections list the pros and cons of both technologies.
The pros of intrusion detection include the following:
These are the cons:
The pros of intrusion prevention include the following:
The cons are as follows:
There are several untrue intrusion-detection and intrusion-prevention myths. These assertions repeatedly come up, even though some are diametrically opposed to others.
Myth 1: Intrusion detection and intrusion prevention are basically the same technology. Many believe that because some IDS systems have TCP kill and RESET capabilities that they are pretty much the same thing as IPS. The truth is that each of these technologies are separate in design and in function. An IPS device sits inline, and all the packets have to pass through it. If a suspicious packet has been detected, it can be dropped. With IDS this is not the case—the suspicious packets are sent on to the internal interface to be analyzed, an alert is then sent, and a response generated. The latency involved in an IDS often results in a failed response. That is because an IDS is designed for detecting intrusions, not responding to them, though they do have some rudimentary response capabilities.
Myth 2: Intrusion-detection systems give too many false positives to be of any