What is Firewall?  Design goals – All traffic from inside to outside

What is Firewall? Design goals – All traffic from inside to outside and vice versa must pass through the firewall – A single checking point that keeps unauthorized traffic (i.e., worm) out of the protected network Internet

How it functions? Technique – Control access via security policy Types – Packet filter router – Application-level gateway – Stateful filter vs. stateless filter – Personal firewall

Packet-Filtering Router Packet-Filtering Router – – – Applies a set of rules to each incoming IP packet Decides forwarding or discarding the packet Only examine the header, do not “see inside” a packet Pros & Cons – – Simple No application-specific protection HTTP Telnet Internet 129.10.10.1 209.10.10.1

Packet-Filtering Router Filtering rules – Src/dest IP address; src/dest port; protocol field; etc. – Default Discard vs. forward action Internal host address Internal port External host address External port function block * * 192.10.*.* * Block all packets from 192.10.*.* action Internal host address Internal port External host address External port function allow 129.10.10.3 25 * * Allow inbound mail to 129.10.10.3

Packet-Filtering Router The dangerous services – – – – – finger (port 79) telnet (port 23) ftp (port 21) rlogin (port 513) ICMP finger Telnet Internet ftp rlogin

Stateful Inspection Firewall Stateful Inspection Firewall – Maintains state information from one packet to another in the input stream – Tightens up the rules for TCP traffic Source address Source port Destination address Destination port State 192.10.10.16 3321 216.10.18.123 80 established

Application-level gateway Application level proxy/gateway – – – – Relay of application traffic Run pseudoapplications Looks to the inside as if it is the outside connection Looks to the outside as if it is the inside Pros & Cons – – Processing overhead Diverse functionality HTTP SMTP Internet FTP TELNET

Considerations Deployment – Performance – Security of firewall itself – Runs on minimized OS non-firewall functions should not be done on the same machine Network Topology HTTP SMTP Internet FTP TELNET Packet filter Application gateway

Personal Firewall Personal Firewall – An application that runs on a personal computer to block unwanted traffic Product – ZoneAlarm www.zonelabs.com – BlackICE Defender blackice.iss.net – Tiny Personal Firewall www.tinysoftware.com – Norton Personal Firewall www.symantec.com – Windows

Benefit & Limitation Benefit – Provides a location for monitoring security-related events – Provides a platform for security-related functions: NAT, IPSec Limitations – – – – Attacks that bypass firewall Internal threats Performance Usability vs. security

Intrusion Detection System

Background What is Intrusion – An intrusion can be defined as any set of actions that attempt to compromise the integrity, confidentiality or availability of a resource. [Heady R. 1990] Three classes of intruder Masquerader – illegitimate user penetrates the system using a legitimate user’s account Misfeasor – legitimate user misuses his/her privileges, accessing resources that is not authorized Clandestine user -- privileged suppress audit control user uses supervisory control to

Background What is Intrusion Detection System – An Intrusion Detection System (IDS) must identify, preferably in real time, unauthorized use, misuse and abuse of computer systems – It is a reactive, rather than proactive, form of system defense. Classification – Misuse intrusion detection vs. Anomaly intrusion detection Misuse intrusion detection -- detect attacks on known weak points of a system. Anomaly intrusion detection -- detect by building up a profile of the system being monitored and detecting significant deviations from this profile. – Host-based detection vs. Network-based detection

History Conventional approach to system security: Authentication, Access control and Authorization. In 1980, James Anderson first proposed that audit trails should be used to monitor threats. In 1987, Dorothy Denning presented an abstract model of an Intrusion Detection System. In 1988, IDES (Intrusion Detection Expert System) – host-based IDS is developed. In 1990, Network Security Monitor is developed – network-based IDS is developed. In 1994, Mark Crosbie and Gene Spafford suggested the use of autonomous agents in order to improve the scalability, maintainability, efficiency and fault tolerance of an IDS.

Structure of IDS Alerting System Data collection Agent Manager Classifier Agent Agent Agent I II III Agent IV Data reduction Data Systemcollection Call Audit Files system Data reduction system Classifier Alerting system

Data Collection and Reduction Data source – Audit files system audit files: messages,xferlog,syslog,sulog, .bash history. application audit files: Web server log files, . – System Call Audit record [Denning 87] – Subject, Action, Object, Exception, Resource usage, Time stamp – User operation elementary actions COPY GAME.EXE to /usr/GAME.EXE Smith exec COPY.EXE 0 CPU 00002 1058721678 Smith read GAME.EXE 0 RECORDS 1 1058721679 Smith exec COPY.EXE Write-viol RECORDS 0 1058721680

Misuse intrusion detection Misuse intrusion detection – Use patterns of well-known attacks or weak spots of the system to match and identify intrusions – Perform pattern matching – Used in the environment where a rule can be recognized. Example Misuse Intrusion Detection (Purdue) using Patten Matching USTAT, a real-time IDS (UCSB) using State Transition Analysis IDES using rule - based expert system

Port scan Password guessing

Anomaly Intrusion Detection Anomaly Intrusion Detection – Establish normal usage profiles – Observe deviation from the normal usage patterns – Example profiles: loginfrequency, locationfrequency, UseofCPU,UseofIO, ExecutionFrequencyFileReadFails 、 FileWriteFails Metrics – – – – Mean and standard deviation Multivariate Markov process Time Series Approaches – Data Mining Approaches – Neural Networks – Colored-petri-net

Distributed IDS

Honey Pot Honeypots are closely monitored network decoys Distract adversaries from more valuable machines on a network Provide early warning about new attack and exploitation trends Example Honeypot can simulate one or more network services that you designate on your computer's ports.

Product http://www.snort.org/ – http://www.dshield.org/ – – A distributed intrusion detection system, or a distributed firewall system. an attempt to collect data about cracker activity from all over the internet. This data will be cataloged and summarized. It can be used to discover trends in activity and prepare better firewall rules. Right now, the system is tailored to simple packet filters. As firewall systems that produce easy to parse packet filter logs are now available for most operating systems, this data can be submitted and used without much effort. NFR Security Inc. – Snort is an open source network intrusion prevention and detection system utilizing a rule-driven language, which combines the benefits of signature, protocol and anomaly based inspection methods. NFR Security provides a comprehensive, integrated intrusion detection system that protects networks and hosts from known/unknown attacks, misuse, abuse and anomalies. http://www.nfr.com Real Secure by ISS http://www.iss.net/products services/enterprise protection/

Outline Introduction A Frame for Intrusion Detection System Intrusion Detection Techniques Ideas for Improving Intrusion Detection

What is the Intrusion Detection Intrusions are the activities that violate the security policy of system. Intrusion Detection is the process used to identify intrusions.

Types of Intrusion Detection System(1) Based on the sources of the audit information used by each IDS, the IDSs may be classified into – Host-base IDSs – Distributed IDSs – Network-based IDSs

Types of Intrusion Detection System(2) Host-based IDSs – Get audit data from host audit trails. – Detect attacks against a single host Distributed IDSs – Gather audit data from multiple host and possibly the network that connects the hosts – Detect attacks involving multiple hosts Network-Based IDSs – Use network traffic as the audit data source, relieving the burden on the hosts that usually provide normal computing services – Detect attacks from network.

Intrusion Detection Techniques Misuse detection – Catch the intrusions in terms of the characteristics of known attacks or system vulnerabilities. Anomaly detection – Detect any action that significantly deviates from the normal behavior.

Misuse Detection Based on known attack actions. Feature extract from known intrusions Integrate the Human knowledge. The rules are pre-defined Disadvantage: – Cannot detect novel or unknown attacks

Misuse Detection Methods & System Method Rule-based Languages State Transition Analysis Colored Petri Automata Expert System Case Based reasoning

Anomaly Detection Based on the normal behavior of a subject. Sometime assume the training audit data does not include intrusion data. Any action that significantly deviates from the normal behavior is considered intrusion.

Anomaly Detection Methods & System Method Statistical method Machine Learning techniques Time-Based inductive Machine Instance Based Learning Neural Network Data mining approaches

Anomaly Detection Disadvantages Based on audit data collected over a period of normal operation. – When a noise(intrusion) data in the training data, it will make a mis-classification. How to decide the features to be used. The features are usually decided by domain experts. It may be not completely.

Misuse Detection vs. Anomaly Detection Advantage Disadvantage Misuse Detection Accurately and generate much fewer false alarm Cannot detect novel or unknown attacks Anomaly Detection Is able to detect unknown attacks based on audit High false-alarm and limited by training data.

The Frame for Intrusion Detection

Intrusion Detection Approaches 1. 2. 3. Define and extract the features of behavior in system Define and extract the Rules of Intrusion Apply the rules to detect the intrusion Audit Data 3 Training Audit Data 1 Features 2 Rules 3 Pattern matching or Classification

Thinking about The Intrusion Detection System Intrusion Detection system is a pattern discover and pattern recognition system. The Pattern (Rule) is the most important part in the Intrusion Detection System – – – Pattern(Rule) Expression Pattern(Rule) Discover Pattern Matching & Pattern Recognition.

Machine Learning & Data mining & Statistics methods Traning Audit Data Feature Extraction Training Data & Knowled ge Pattern Extraction Expert Knowledge & Rule collection & Rule abstraction Pattern & Decision Rule Pattern Matching Alarms Intrusion Detection System Discriminate function Pass Pattern Recognition Real-Time Aduit data

Rule Discover Method Expert System Measure Based method – Statistical method – Information-Theoretic Measures – Outlier analysis Discovery Association Rules Classification Cluster

Pattern Matching & Pattern Recognition Methods Pattern Matching State Transition & Automata Analysis Case Based reasoning Expert System Measure Based method – Statistical method – Information-Theoretic Measures – Outlier analysis Association Pattern Machine Learning method

Intrusion Detection Techniques

Intrusion Detection Techniques Pattern Matching Measure Based method Data Mining method Machine Learning Method

Association Pattern Discover Goal is to derive multi-feature (attribute) correlations from a set of records. An expression of an association pattern: The Pattern Discover Algorithm: 1. 2. Apriori Algorithm FP(frequent pattern)-Tree

Association Pattern Detecting Statistics Approaches – Constructing temporal statistical features from discovered pattern. – Using measure-based method to detect intrusion

Machine Learning Method Time-Based Inductive Machine – Like Bayes Network, use the probability and a direct graph to predict the next event Instance Based Learning – Define a distance to measure the similarity between feature vectors Neural Network

Classification This is supervised learning. The class will be predetermined in training phase. Define the character of classes in training phase. A common approach in pattern recognition system

Clustering This is unsupervised learning. There are not predetermined classes in data. Given a set of measurement, the aim is that establishes the class or group in the data. It will output the character of each class or group. In the detection phase, this method will get more time cost (O(n2)). I suggest this method only use in pattern discover phase

Association Pattern Detecting Using the pattern matching algorithm to match the pattern in sequent data for detecting intrusion. No necessary to construct the measure. But its time cost depends on the number of association patterns. Constructs a pattern tree to improve the pattern matching time cost to linear time

Discover Pattern from Rules The existing rules are the knowledge from experts knowledge or other system. The different methods will measure different aspects of intrusions. Combine these rules may find other new patterns of unknown attack. For example: – Snort has a set of rule which come from different people. The rules may have different aspects of intrusions. – We can use the data mining or machine learning method to discover the pattern from these rule.

Machine Learning & Data mining & Statistics methods Traning Audit Data Feature Extraction Training Data & Knowled ge Pattern Extraction Expert Knowledge & Rule collection & Rule abstraction Pattern & Decision Rule Pattern Matching Alarms Intrusion Detection System Discriminate function Pass Pattern Recognition Real-Time Aduit data

Penetration Testing 1. Define target and requirements. 2. Obtain a trusted agent. 3. Prepare test plan. 4. Obtain management signoff. 5. Confirm target addresses. 6. Port scanning

Penetration Testing 7. Enumeration of web interfaces. 8. Initial vulnerability assessment using port scanner. 9. Verification scanned results. 10. Exploit vulnerabilities. 11. Password cracking. 12. Profile the target system.

Penetration Testing 13. Try to find valuable info in hidden fields of html, xml, forms, applets and dynamically generated pages. 14. Try to attack application servers. 15. Glean info from banners, welcome messages and help screens.

Penetration Testing 16. Glean info from cookies and session IDs. 17. Try to determine login access controls. 18. Try to spoof IDs and replay passwords. 19. Try to decompile code. 20. Try to view the password rules. 21. Locate and try to attack the DNS.