 that anomaly-based schemes not only define activities that are not allowed, but also activities that are allowed. In addition, anomaly detection is typically used for its ability to collect statistical behavior and characteristic behavior. Statistics are quantitative and characteristics are more qualitative. For example, “This server’s UDP traffic never exceeds 25 percent of capacity” describes a statistical behavior, and “User Stan321 does not normally FTP files outside of the company” describes a characteristic behavior.
Anomaly-based schemes fall into three main categories: behavioral, traffic pattern, and protocol. Behavioral analysis looks for anomalies in the types of behavior that have been statistically baselined, such as relationships in packets and what is being sent over a network. Traffic-pattern analysis looks for specific patterns in network traffic. Protocol analysis looks for network protocol violations or misuse based on RFC-based behavior.
Protocol analysis has the benefit of identifying possible attacks that are not yet publicized or that there is no known signature or remedy for.
Requests for Comments (RFCs) are a series of notes about aspects of the Internet, such as protocols. A document can be sent to the Internet Engineering Task Force (IETF), which is a standards organization for the Internet, and they will determine whether it becomes an RFC. See www.faqs.org/rfcs/ for more info about RFCs.
Again, let’s review the analysis model in the context of anomaly detection:
Target-monitoring systems will report whether certain target objects have been changed or modified. This is usually done through a cryptographic algorithm that computes a cryptochecksum for each target file. The IDS reports any changes, such as a file modifications or program logon, which would cause changes in cryptochecksums
Tripwire software will perform target monitoring using cryptochecksums by providing-instant notification of changes to configuration files and enabling automatic restoration. The main advantage of this approach is that you do not have to continuously monitor the target files.
Stealth probes correlate data to try to detect attacks made over a long period of time, often referred to as “low and slow” attacks. Data are collected from a variety of sources, and it is characterized and sampled to discover any correlating attacks. This technique is also referred to as wide-area correlation, and it is typically a combination or hybrid approach that uses other detection methods to try and uncover malicious behavior.
The term heuristics refers to artificial intelligence (AI). In theory, an IDS will identify anomalies to detect an intrusion, and it will then learn over time what can be considered normal. To use heuristics, an AI scripting language can apply analysis to the incoming data.
Heuristics still leave a lot to be desired at this stage, but development is progressing. What is needed is a pattern-matching language that can use programming constructs to learn and identify malicious activity more accurately.
We have examined the fundamental analysis schemes. You will find that there is much debate on which is considered the best approach. In actuality, they all have their merits and drawbacks, but when they are used together they can offer a more robust security system. Products that use a hybrid approach typically perform better, especially against complex attacks.
We have looked at the theory of IDS patterns and analysis schemes. It seems appropriate at this point to examine few IDS rules to illustrate those concepts.
The following is an IDS rule from an open source network IDS called Snort that detects whether the NetBus back door is running on a system:
alert tcp $HOME_NET 12345:12346 -> $EXTERNAL_NET any (msg:"BACKDOOR netbus active"; flow:from_server,established; content:"NetBus"; reference:arachnids,401; classtype:misc-activity; sid:109; rev:4;)
From this rule, we can see that Snort will send an alert if a TCP packet on ports 12345–12346 come through. If that happens, Snort sends the message of “BACKDOOR netbus