1. Technical Field
The present disclosure relates generally to security and, more particularly, to a method and system for computer security.
2. Description of the Related Art
With the growth of the Internet, the increased use of computers and the exchange of information between individual users has posed a threat to the security of computers. Computer security attempts to ensure the reliable operation of networking and computing resources and attempts to protect information on the computer or network from unauthorized access or disclosure. Computer system(s) as referred to herein may include(s) individual computers, servers, computing resources, networks, etc. Among the various security threats that present increasingly difficult challenges to the secure operation of computer systems are computer viruses, worms, Trojan horses, etc. These intrusions attempt to compromise system information and/or system resources by deleting files, system settings, etc, or by allowing intruders to modify the files on a system, either unintentionally as a consequence of their intrusion, or in order to further compromise computer security by installing Trojans, password recorders, etc.
Intruders might launch a number of different types of attacks on computer systems, including information gathering attacks, exploits, or denial of service (DoS) attacks, etc. Information gathering attacks allow intruders to perform a number of harmful actions on a computer system, including stealing confidential information such as credit cards, passwords, etc. Exploits allow attackers to make use of vulnerabilities in target servers or misconfigurations on the computer system. For example, web servers and web browsers often have a series of security loopholes. Attackers take advantage of these loopholes by executing attacks such as, buffer overflow attacks. A buffer overflow attack occurs when a program attempts to write more data onto a buffer area in the web server than it can hold. This causes an overwriting of areas of stack memory in the web server. If performed correctly, this allows malicious code to be placed on the web server which would then be executed. Denial of service attacks allow intruders to prohibit users from accessing resources on the computer system. Intruders make the system inaccessible by overloading computer system resources or crashing a service or machine on the computer system, etc.
Users may install firewalls in order to attempt to protect their computer systems from attack. A firewall may include a computer system and/or software system composed of a set of related programs that is placed between a private computer system and a public network (i.e., Internet). A firewall provides security protection to the system by screening incoming requests and preventing unauthorized access. Firewalls operate by working with router programs to determine the next destination to send information packets, ultimately deciding whether or not to forward the packets to that location. Firewalls can also impose internal security measures on users in the system by preventing them from accessing certain materials, such as websites on the World Wide Web, that may have unknown and potentially dangerous security consequences.
However, firewalls do not provide a computer system with comprehensive protection against attacks. Firewalls stop communication and only allow the traffic that a system administrator permits to go through. However, firewalls have no capability of detecting whether or not traffic that is legitimately allowed through is really an attack.
Users may also utilize intrusion detection systems in order to protect their computer systems from attack. Intrusion detection is the process where data is inspected for malicious, inaccurate or irregular activity. Intrusion detection systems may include host based intrusion detection systems and/or network intrusion detection systems. Host based intrusion detection systems (HIDS) monitor and report security lapses for the host on which the system runs by checking log files, users, and the file system. Network intrusion detection systems (NIDS) operate to protect computer systems from foreign intrusions by monitoring all network traffic and logging suspicious behavior. There are two forms of NIDS, pattern matching systems and anomaly based systems. Pattern matching systems inspect each network packet and compare it to prior information about specific attacks compiled in a signature database. If a match is found, an alarm is triggered and the system administrator is notified. Anomaly based systems create a profile of normal network traffic and compare it to the profile of the current network. Any irregular traffic will trigger an alarm and notify the system administrator.
However, conventional intrusion detection systems also do not provide a computer system with comprehensive protection against attacks. The problem with pattern matching NIDS is that the signature database needs to be continuously updated in order to detect new and modified intrusions. This not only proves to be a very tedious and time consuming task but also doesn't happen often enough to provide adequate safeguards against foreign intrusions. Furthermore, pattern matching NIDS may detect and block a large number of packets, even though those packets may not be malicious. A problem with anomaly based NIDS is that as networks grow, it becomes hard to create a profile of normal network traffic. Hackers may even generate their own traffic in order to distort the profile of normal network traffic and get past the intrusion detection system. In either type of system, if the intrusion detection system narrowly characterizes “normal”, then the system may generate a large amount of false positives, increasing the monitoring burden on users which may cause users to ultimately ignore the intrusion detection system.
Accordingly, a need exists for techniques that overcome the disadvantages of conventional methods of security protection. It would be beneficial to have methods and systems for preventing security breaches altogether and ensuring that exploitation of system vulnerabilities will never come to light.