SystemsSec 2018W Lecture 16 - Revision history

Trent: separated definitions of signature based/specification based/anomaly dection intrusion detection from host based/network based/hybrid. Updated definitions.

2018-03-25T03:58:39Z

separated definitions of signature based/specification based/anomaly dection intrusion detection from host based/network based/hybrid. Updated definitions.

← Older revision		Revision as of 03:58, 25 March 2018
Line 27:		Line 27:
	==Three main methods of Intrusion Detection==		==Three main methods of Intrusion Detection==

	1) Signature based - ~~Takes place with the Host~~.		1) Signature based - pattern recognition. You have a blacklist of signatures of attacks, and if it matches a signature, a warning is issued.
	2) Specification based - ~~Takes place with at the Network~~.		2) Specification based - based on rules. A whitelist of normal system specifications. If something not on your list is detected, a warning is issued.
	3) Anomaly Detection - (~~Hybrid) Combination~~ of ~~the Host~~ and ~~the Network.~~		3) Anomaly Detection - Normal vs abnormal. You have some way of detecting "weird". Implies something adaptive.
			Any of these 3 types of intrusion detection can be host based, network based, or hybrid (combination of host and network)

	==IDS In Linux==		==IDS In Linux==

Benjamin at 20:47, 12 March 2018

2018-03-12T20:47:05Z

← Older revision		Revision as of 20:47, 12 March 2018
Line 22:		Line 22:
	- In each example our goals have been satisfied but the means are different.		- In each example our goals have been satisfied but the means are different.
	- intrusion detection focuses on the goals of the attacker and to stop them.		- intrusion detection focuses on the goals of the attacker and to stop them.
	- ~~For option 3 the~~ attacker ~~was able to~~ gain access by intrusion ~~not~~ malware.		- The attacker can still gain access by intrusion without using malware.

Benjamin at 20:44, 12 March 2018

2018-03-12T20:44:53Z

← Older revision		Revision as of 20:44, 12 March 2018
Line 68:		Line 68:
	-If packets are rerouted throught Client B <------> Client C then we consider an attack took place.		-If packets are rerouted throught Client B <------> Client C then we consider an attack took place.
	-Can detect forged packets, specify the behaviour of every application.		-Can detect forged packets, specify the behaviour of every application.
	-Each client needs a separate installation and is a different specification. In order for Specification ~~intrusion detection~~ to work we need to understand what ~~your~~ networks need and specify the rules.		-Each client needs a separate installation and is a different specification.
			-In order for Specification Intrusion Detection to work we need to understand what are the networks need and to specify the rules.


	-Vary rare that one person understand the entire network and is able to write the rules for every client.		-Vary rare that one person understand the entire network and is able to write the rules for every client.
	~~-We are not confident with the network traffic and want to set an alarm.~~
	-Borders on access control: Users will enable/disable permissions and will find methods to bypass access control.		-Borders on access control: Users will enable/disable permissions and will find methods to bypass access control.

Benjamin at 20:42, 12 March 2018

2018-03-12T20:42:23Z

← Older revision		Revision as of 20:42, 12 March 2018
Line 43:		Line 43:
	Is based on code pattern and code expressions ie. worms and bytes associated the worm, regex and Bad packets		Is based on code pattern and code expressions ie. worms and bytes associated the worm, regex and Bad packets
	- Involves white list		- Involves white list
	- We must know what signatures belong to the ~~Blacklists~~ there is no limit to bad signatures.		- We must know what signatures belong to the list there is no limit to bad signatures.
	- Only “known” attacks can be caught.		- Only “known” attacks can be caught.
	- How do you match bad code with legit behaviours?		- How do you match bad code with legit behaviours?
Line 83:		Line 83:
	-We care only if its dangerous, a mix of dangerous and weird		-We care only if its dangerous, a mix of dangerous and weird

	-We Must define whats weird and its connection to dangerous ie a person walking in with a bazooka vs awkard guy wearing		-We Must define whats weird and its connection to dangerous ie. a person walking in with a bazooka vs awkard guy wearing the fluorescent shirt.
	the fluorescent shirt.

Benjamin at 20:40, 12 March 2018

2018-03-12T20:40:56Z

Show changes

Benjamin at 20:25, 12 March 2018

2018-03-12T20:25:40Z

← Older revision		Revision as of 20:25, 12 March 2018
Line 3:		Line 3:
	[https://homeostasis.scs.carleton.ca/~soma/systemssec-2018w/lectures/comp4108-2018w-lec16-12Mar2018.m4a Lecture 16 Audio]		[https://homeostasis.scs.carleton.ca/~soma/systemssec-2018w/lectures/comp4108-2018w-lec16-12Mar2018.m4a Lecture 16 Audio]

	'''Intrusion Detection'''		=='''Intrusion Detection'''==

	- Intrusion detection is normally an underappreciated aspect of Internet Security		Intrusion detection is normally an underappreciated aspect of Internet Security. Alerts are sent when we don’t know or we're not confident what the network traffic is.
	~~- Intrusion detection:~~ Alerts are sent when we don’t know or ~~were~~ not confident what the network traffic is.		Why Intrusion detection matters:
	- Why Intrusion detection matters:
	1) Firewalls are not as effective.		1) Firewalls are not as effective.
	2) Firewalls have limitations.		2) Firewalls have limitations.

	- Intrusion detection is not anti-malware.		Intrusion detection is not anti-malware. It is meant to detect intrusions, but it may involve malware.
	~~- Intrusion detection~~ is meant to detect intrusions, but it may involve malware.
	- Intrusion vs. malware		=='''Intrusion vs. malware'''==
	-> ex. industrial espionage: We want access to a competitors system.
			-ex. industrial espionage: We want access to a competitors system.
	OPTIONS:		OPTIONS:
	1) Gain access by malware via email or link etc.		1) Gain access by malware via email or link etc.
Line 20:		Line 20:
	3) Call help desk and impersonate.		3) Call help desk and impersonate.

	-> In each example our goals have been satisfied but the means are different.		- In each example our goals have been satisfied but the means are different.
	-> intrusion detection focuses on the goals of the attacker and to stop them.		- intrusion detection focuses on the goals of the attacker and to stop them.
	-> For option 3 the attacker was able to gain access by intrusion not malware.		- For option 3 the attacker was able to gain access by intrusion not malware.


	== '''Three main methods of Intrusion Detection~~: ==~~'''		=='''Three main methods of Intrusion Detection'''==
	~~'''~~1)Signature based~~:'''~~ Takes place with the Host.		These are:
	~~'''~~2)Specification based~~:'''~~Takes place with at the Network.		1) Signature based -> Takes place with the Host.
	~~'''~~3)Anomaly Detection~~:'''~~ Hybrid (Combination of the Host and the Network).		2) Specification based -> Takes place with at the Network.
			3) Anomaly Detection -> Hybrid (Combination of the Host and the Network).

	~~'''~~IDS in Linux~~'''~~		IDS in Linux
	1)Snort - Signature Based Detection		1)Snort - Signature Based Detection
	2)Bro - Specification Based Detection		2)Bro - Specification Based Detection

Benjamin: /* Notes */

2018-03-12T20:06:57Z

Notes

← Older revision		Revision as of 20:06, 12 March 2018
Line 3:		Line 3:
	[https://homeostasis.scs.carleton.ca/~soma/systemssec-2018w/lectures/comp4108-2018w-lec16-12Mar2018.m4a Lecture 16 Audio]		[https://homeostasis.scs.carleton.ca/~soma/systemssec-2018w/lectures/comp4108-2018w-lec16-12Mar2018.m4a Lecture 16 Audio]

	==~~Notes~~==		'''Intrusion Detection'''

			- Intrusion detection is normally an underappreciated aspect of Internet Security
			- Intrusion detection: Alerts are sent when we don’t know or were not confident what the network traffic is.
			- Why Intrusion detection matters:
			1) Firewalls are not as effective.
			2) Firewalls have limitations.

			- Intrusion detection is not anti-malware.
			- Intrusion detection is meant to detect intrusions, but it may involve malware.
			- Intrusion vs. malware
			-> ex. industrial espionage: We want access to a competitors system.
			OPTIONS:
			1) Gain access by malware via email or link etc.
			2) Password hack as alternative.
			3) Call help desk and impersonate.

			-> In each example our goals have been satisfied but the means are different.
			-> intrusion detection focuses on the goals of the attacker and to stop them.
			-> For option 3 the attacker was able to gain access by intrusion not malware.


			== '''Three main methods of Intrusion Detection: =='''
			'''1)Signature based:''' Takes place with the Host.
			'''2)Specification based:'''Takes place with at the Network.
			'''3)Anomaly Detection:''' Hybrid (Combination of the Host and the Network).

			'''IDS in Linux'''
			1)Snort - Signature Based Detection
			2)Bro - Specification Based Detection


			Each method has a cost which has to be weighed ie. cpu cycles, to many false alarms and etc.

			'''Signature Based:''' Is based on code pattern and code expressions ie. worms and bytes associated the worm, regex and Bad packets
			Involves white list

			We must know what signatures belong to the Blacklists there is no limit to bad signatures.
			Only “known” attacks can be caught.
			How do you match bad code with legit behaviours?
			Easily evaded. Can hide code signature???

			Since we don't know for sure which signatures belong on the blacklist. The network will generate lots of alarms, to
			lower false positives the detection rules may be adjusted which may compromise the system.

			Why not update to defend code signatures? May effect existing software.



			'''Specification based:''' We know how the system behaviour and rules on how it operates. Ie
			Involves blacklists

			For Example:

			Assume three clients: A,B,C

			Client A and B can communicate to each other: Client A <----> Client B
			Client A and C can communicate to each other: Client A <----> Client C

			But Client B can not talk to C

			-If packets are rerouted throught Client B <------> Client C then we consider an attack took place.
			-Can detect forged packets, specify the behaviour of every application.
			-Each client needs a separate installation and is a different specification. In order for Specification intrusion detection to work we need to understand what your networks need and specify the rules.


			-Vary rare that one person understand the entire network and is able to write the rules for every client.
			-We are not confident with the network traffic and want to set an alarm.
			-Borders on access control: Users will enable/disable permissions and will find methods to bypass access control.


			'''Anomaly Detection:''' Whats normal vs whats abnormal ie. computer is suddenly not running is it a driver issue? or actually malware?
			adaptive, statistical information how the system behaves and deviations, training

			Example someone wearing a fluorescent shirt? But is it dangerous?
			We care only if its dangerous, a mix of dangerous and weird

			We Must define whats weird and its connection to dangerous ie a person walking in with a bazooka vs awkard guy wearing
			the fluorescent shirt.


			'''History'''

			In the 1970's Ross Anderson and the US Airforce had a problem. They had computers with sensitive data and were worried spies may extract information. Access control existed but wasn't the best idea.

			MOS was then implemented to allow some users privileges to view these files based on levels.

			The level of clearance according to level:

			Top secret
			secret
			unclassified

			Problem: The document may become top secret if only one word needs to be kept secret. The rest of the document may not have to be classified but the one word whould make the document classified. Gets complicated!!!.

			Didn't work since it the level of clearance can be bypassed the same way passwords can be bypassed.

			That's why audits were invented.

			'''Audit'''
			An audit whould produce an audit trail of all the computer activities ie. log in,log out, what applications are being accessed and etc.

			The idea was a security officer whould monitor and view the audit logs then investigate if suspicious activity was detected.The process was simmilar to a financial audit but the pattern recognition was based on computers.

			Statistics based on a the audit trail whould be used to determine the users activities ie. how many times a user logged in.

			The fundamental issue: 1) Creating a model of what a human is doing is difficult.
			2) Auditing was created with the intention of a human doing the processing.
			3) The computer does not have sufficient data to analyze.

			Possible solutions: machine learning ?? neuronetworks?? Spy on your email ( all dumb ideas)!!!!
			Why is it dumb 1) We must be able to model the real world
			2) We can't learn everything based on the limited scope.
			3) Assuming we really know someone?? Can we really perdict there behaviour? even surprises??

			The computer can understand programs but not humans. It can detect weird program behaviour but not weird users and programs acting weird ie. backdoors and memory overflows.

Soma: Created page with "==Audio== [https://homeostasis.scs.carleton.ca/~soma/systemssec-2018w/lectures/comp4108-2018w-lec16-12Mar2018.m4a Lecture 16 Audio] ==Notes=="

2018-03-12T16:24:00Z

Created page with "==Audio== [https://homeostasis.scs.carleton.ca/~soma/systemssec-2018w/lectures/comp4108-2018w-lec16-12Mar2018.m4a Lecture 16 Audio] ==Notes=="

New page

==Audio==

[https://homeostasis.scs.carleton.ca/~soma/systemssec-2018w/lectures/comp4108-2018w-lec16-12Mar2018.m4a Lecture 16 Audio]

==Notes==