1 of 56

PLAN:

  1. Detecting and preventing attacks
  2. Detecting abnormal (anomalous) behavior
  3. Preventing system intrusion
  4. Preventing network intrusion
  5. DDoS – attack protection

14-lecture. Detecting and mitigating attacks

2 of 56

There are programs created to attack someone's computer, delete data on that computer, steal someone's information, and use someone's resources without permission.

Attack detection - this is the process of detecting attempts to compromise the confidentiality, integrity, and access breach attempts.

Preventing intrusion - this is the process of blocking detected intrusions. Previously, only two security layers were installed around the network - firewall and intrusion detection system (IDS- Intrusion Detection System) detection systems.

Intrusion detection system - this designed to log suspicious activities on the network and send notifications to the management console, email messages, SMS messages to a mobile phone, etc., to notify the staff responsible for information security.

Firewalls (FW) pass traffic themselves but do not inspect the transmitted data; they only analyze IP packet headers. In contrast, IDS systems analyze the data that passes through the firewall but cannot block attacks because no traffic passes through them. Where these two technologies intersect, a new class of security tools emerged – the Intrusion Prevention System (IPS) – a system that prevents intrusion.

3 of 56

4 of 56

Attack detection and prevention

 

The Intrusion Prevention System (IPS) is designed to ensure the safety of protected objects against attacks that are recognized as attempts to infiltrate the IR.

IPS systems have become so popular that some manufacturers have begun advertising their IDS as intrusion prevention systems, i.e., IPS, thereby undeservedly opening new markets and attracting new customers.

In fact, IPS systems are far superior to IDS intrusion detection systems. IPS systems combine a variety of security technologies and are much more advanced than their predecessors, the IDS intrusion detection systems.

5 of 56

6 of 56

Key concepts

Intrusion detection and prevention tools (IPS) automate these processes and are crucial for preventing damage and losses caused by attacks at any organizational level. Unlike IDS, the true characteristics of an IPS are as follows:

The IPS operates in inline mode at line speed (it passes traffic through itself). In other words, the IPS solution does not reduce data throughput;

The IPS ensures that transmitted packets are assembled in the correct order and analyzes these packets to detect traces of unauthorized activity.

During analysis, various attack detection methods are employed—signature-based and behavior-based techniques, as well as anomaly detection in protocols;

The IPS is capable of blocking malicious traffic.

Thus, converting an IDS to an IPS is not just a matter of swapping a single letter in the name; it requires altering the solution's principles by incorporating new technologies.

When considering IPS, the classification inherited from intrusion detection systems is applied.

7 of 56

NIPS (Network-based IPS) network system – a tool that prevents the intrusion of network traffic that interferes with and monitors the network stack.The main function of the NIPS network is to protect groups of network hosts from possible attacks, analyze transmitted traffic, and block traffic related to attacks.

HIPS (Host-based IPS) host system – a host‑based intrusion prevention tool located on a specific host that protects it from malicious influences by analyzing network traffic, application behavior, system calls, and so on.

IPS also protects against distributed denial‑of‑service attacks.

Nowadays many defenses combine detection and blocking of attacks, which is why they are sometimes called IDS/IPS products.

However, using only IPS tools is not sufficient for effective protection – it is usually advisable to proactively identify the vulnerabilities, called holes, in corporate information systems (CIS) that attackers could exploit to successfully carry out an attack. These holes can be weak passwords, misconfigurations of network device settings, vulnerabilities in operating systems and applications, and so on.

8 of 56

9 of 56

Special tools—vulnerability scanners—are available for searching and identifying such vulnerabilities (Security assessment). Their use in corporate information systems significantly increases the level of protection: by identifying weak points, security staff can take appropriate measures to eliminate them before attackers can exploit them. Recently, specialized tools that provide an automated process for mitigating vulnerabilities have begun to appear, but so far only a few vendors offer such solutions.

To minimize the risk of the negative impact of attacks, IPS tools, vulnerability scanners, and mitigation tools need to be integrated into a single small system with centralized management.

Access prevention solution sensors, one or more management servers, vulnerability scanners, remediation tools, operator and administrator consoles.

10 of 56

Access prevention system for corporate information systems

11 of 56

Detecting IPS intrusion

 

In the process of detecting intrusion, the following methods of analyzing events are used:

  • Detection of abnormal (anomalous) behavior where abnormal events are identified (Anomaly-based);
  • Detection of unauthorized use based on signatures, where an event or set of events is examined against a predefined pattern (template) that describes a known attack. The form of a known attack is called a signature.

12 of 56

Detection of Abnormal (Anomalous) Behaviors

 

The technology for detecting attacks by identifying anomalous behavior is based on the following hypothesis. A user's abnormal actions (i.e., an attack or some hostile activity) often manifest as a deviation from normal behavior. Access attempt events differ from typical user activity or interactions of household members, and therefore can be detected.

Examples of abnormal behaviors include a very large number of connections within a short period, excessive use of the processor, etc. Sensors collect event data, build models of normal activity, and use various indicators to detect anomalies.

If it is possible to precisely define the profile of typical user behavior, then any deviation can be identified as an anomalous behavior. However, abnormal behaviors are not always attacks. For example, sending many requests to the network infrastructure simultaneously may be detected by the intrusion detection mechanism as a means of rejecting an attack.

13 of 56

14 of 56

Configuring and exploiting operating systems in this category, administrators encounter the following problems:

  • Creating a user profile is a difficult and time‑consuming task, requiring a lot of initial work from the administrator;
  • To reduce the likelihood of one of the two severe scenarios above occurring, determine the boundary values of user behavior characteristic attributes.

Anomaly detection technology is aimed at identifying new types of attacks. However, its drawback is the need for continuous training. So far, anomaly detection technology has not been widely adopted. This is because applying this technology in practice is difficult. Nevertheless, there is now a certain interest in it.

15 of 56

Detecting abuse

 The essence of another approach aimed at detecting attacks—detecting abuse—is to describe the attack in the form of a signature and search for this signature in a controllable field (network traffic or log).

It should be emphasized that reliably detecting the fact of an attack is not sufficient by merely finding a particular movement pattern or signature. For successful attack detection, a modern IPS must have the following features and functions:

  • using knowledge about the protected network topology;
  • analyzing interaction sessions taking into account the protocols used for data transmission;
  • reassembling fragmented IR packets before analyzing them, without checking the fragments of IR diagrams for continuity;
  • creating overlapping parts of IR diagrams, rewriting the composition of TCR segments, and controlling attempts to prevent them;
  • ensuring verification of the logical/format compliance of the protocol with the RFC;
  • performing statistical analysis of data;
  • supporting mechanisms for signature searching;
  • having learning and self‑learning capabilities.

In addition, because an IPS can decide to block traffic, reliable and secure remote management of the IPS must be ensured.

16 of 56

17 of 56

Preventing access to corporate information systems

 

The intrusion detection and prevention system (IPS) includes the following functions:

  • Preventing inbound access at the system (host) level;
  • Preventing inbound access at the network layer;
  • Protection against DDoS attacks;

Preventing entry to the system surface

 

HIPS (Host-based IPS) prevention tools operate at the information‑node level. The HIPS sub‑system quickly blocks attacks at the system level and notifies responsible persons.

HIPS system's (host) access prevention tools can be installed on a workstation or server. Additionally, host level IPS can be implemented in several ways:

  • In the form of a DT installed on the OS. Currently all solutions are limited to UNIX family operating systems;
  • When installed as a DT on a workstation at the upper layer of the OS. Many vendors produce: Cisco Systems, ISS, McAfee, Star Force, etc. IPS also has additional functions that include: controlling USB access, creating a locked software environment, monitoringdata exfiltration, managing the loading of external devices and other functions;
  • IPS can be a small subsystem implemented on a network interface card to mitigate specific attacks. Some manufacturers (specifically, D-Link) produce such devices, but their prevalence is not high

18 of 56

19 of 56

Preventing access to the network perimeter

 

The NIPS (Network-based IPS) intrusion prevention subsystem provides immediate blockage of network attacks and ensures that responsible persons are notified.

Detection of an attack is performed by comparing the bit sequence of the transmitted data stream with the corresponding attack signature, or by analyzing suspicious (abnormal) network activity through network traffic or violations of security policy rules. If attack attempts are detected, countermeasures are applied.

The following countermeasures may be implemented:

  • to block selected network packets;
  • to modify the configuration of other information security subsystems (e.g., TE) to prevent intrusion;
  • to retain selected packets for further analysis;
  • to log events and notify responsible persons.

20 of 56

IPS can be implemented at the network layer as follows:

  • Special devices (Security Appliances) that can be installed on the corporate network perimeter and, in some cases, inside it. These devices are the most common option. The main manufacturers of such tools are Cisco Systems, ISS, Juniper, 3Com, McAfee, and others;
  • Solutions integrated into the corporate network infrastructure.
  • Solutions integrated with the infrastructure are much more efficient than separate additional devices:
  • The price of an integrated solution is lower than that of an independent device;
  • The cost (financial and time) of implementing such a solution is also lower – there is no need to change the network topology;
  • Reliability is higher because there is no extra link in the transport flow chain that could fail;
  • Integrated solutions provide a higher level of protection by being in closer contact with protected resources.

21 of 56

Cisco Systems network layer access prevention scheme based on Cisco Systems products

22 of 56

Comparative characteristics of Network IPS and Host IPS subsystems

Advantages

Disadvantages

Network IPS

Broad application scope – the entire network can be covered with a single network sensor. Minimal inconvenience when updating signatures and installing sensor firmware updates. Prevention of DoS attacks. Ability to detect network‑layer errors in the TCR/IR set. Independence of information nodes from the operating system.

Along with real detections, false positives also occur. Encrypted data streams cannot be analyzed. If there is no signature for a particular attack, new types or variants of attacks will not be detected. Delay in detection and alert (signal) generation. Analyzing packets is difficult when the network is congested. No notification about successful attack execution.

Host IPS

Ability to associate the user with the event. Can detect attacks that NIDS sensors miss. Can analyze encrypted data on the host. Ability to provide information about the host during an attack.

To protect multiple hosts, sensors must be installed on each of them. If the operating system is compromised as a result of an attack, the sensor installed on that host will also cease to function. The sensor cannot detect activity of network browsers. Sensors may be ineffective when attacking a DoS target. Additional resources are required for operation.

23 of 56

24 of 56

DDoS – attack protection

 

One of the most important classes of computer attacks, in terms of consequences, is the “Denial of Service” (DDoS) attacks aimed at disrupting the availability of information resources.

The general approach to protecting against DDoS attacks includes implementing the following mechanisms:

  • Detect traffic;
  • Identify the source of the attack;
  • Prevent intrusion.

DDoS enterprise protection system. This solution requires a comprehensive approach to create a protection system capable of defending not only the individual servers of the enterprise but also the communication channels with the relevant network operators.

Implementing the solution enables the enhancement of security for the corporate network, routers, communication channels, email, web, and DNS servers.

Deploying such a protection system is appropriate in the following cases:

  • companies that conduct their business over the Internet;
  • the presence of a corporate website of the company;
  • use of the Internet to carry out business processes.

25 of 56

26 of 56

DoS – attack (Denial of Service) – this is an attack that disrupts the operation of a server or personal computer due to a large number of requests arriving at high speed to the targeted resource.

DDoS – attack (Distributed Denial of Service) – this is a type of DoS attack organized using a very large number of computers, so it can assault servers even when Internet channels have a very high bandwidth.

27 of 56

Kaspersky DDoS Prevention Service

 

One of the most effective solutions for mitigating DDoS attacks is the Kaspersky DDoS Prevention Service offered by Kaspersky Lab.

To detect malicious traffic during an attack, the Kaspersky DDoS system, among other things, uses the following set of criteria for traffic filtering:

  • static: based on black and white lists, including lists generated by user applications via API;
  • statistical: based on analyzing deviations of traffic statistical parameters from average values;
  • behavioral: based on analysis of compliance or non‑compliance with application protocol specifications;
  • signature‑based: based on analyzing the individual characteristics of bot actions, among others.

28 of 56

Types of virus threats

  1. DDoS attacks
  2. MAC flooding
  3. USB flash
  4. DNS subdomain substitution
  5. Trojan horse (Spyware)
  6. SPAM
  7. Scam
  8. IM (Instant Messaging
  9. Attacks via WEB servers
  10. Password cracker
  11. Remote administration tools
  12. Dialer
  13. Rootkit
  14. Targeted attacks

29 of 56

PLAN:

  1. Detecting and preventing attacks
  2. Detecting abnormal (anomalous) behavior
  3. Preventing system intrusion
  4. Preventing network intrusion
  5. DDoS – attack protection

14-lecture. Detecting and mitigating attacks

30 of 56

There are programs created to attack someone's computer, delete data on that computer, steal someone's information, and use someone's resources without permission.

Attack detection - this is the process of detecting attempts to compromise the confidentiality, integrity, and access breach attempts.

Preventing intrusion - this is the process of blocking detected intrusions. Previously, only two security layers were installed around the network - firewall and intrusion detection system (IDS- Intrusion Detection System) detection systems.

Intrusion detection system - this designed to log suspicious activities on the network and send notifications to the management console, email messages, SMS messages to a mobile phone, etc., to notify the staff responsible for information security.

Firewalls (FW) pass traffic themselves but do not inspect the transmitted data; they only analyze IP packet headers. In contrast, IDS systems analyze the data that passes through the firewall but cannot block attacks because no traffic passes through them. Where these two technologies intersect, a new class of security tools emerged – the Intrusion Prevention System (IPS) – a system that prevents intrusion.

31 of 56

32 of 56

Attack detection and prevention

 

The Intrusion Prevention System (IPS) is designed to ensure the safety of protected objects against attacks that are recognized as attempts to infiltrate the IR.

IPS systems have become so popular that some manufacturers have begun advertising their IDS as intrusion prevention systems, i.e., IPS, thereby undeservedly opening new markets and attracting new customers.

In fact, IPS systems are far superior to IDS intrusion detection systems. IPS systems combine a variety of security technologies and are much more advanced than their predecessors, the IDS intrusion detection systems.

33 of 56

34 of 56

Key concepts

Intrusion detection and prevention tools (IPS) automate these processes and are crucial for preventing damage and losses caused by attacks at any organizational level. Unlike IDS, the true characteristics of an IPS are as follows:

The IPS operates in inline mode at line speed (it passes traffic through itself). In other words, the IPS solution does not reduce data throughput;

The IPS ensures that transmitted packets are assembled in the correct order and analyzes these packets to detect traces of unauthorized activity.

During analysis, various attack detection methods are employed—signature-based and behavior-based techniques, as well as anomaly detection in protocols;

The IPS is capable of blocking malicious traffic.

Thus, converting an IDS to an IPS is not just a matter of swapping a single letter in the name; it requires altering the solution's principles by incorporating new technologies.

When considering IPS, the classification inherited from intrusion detection systems is applied.

35 of 56

NIPS (Network-based IPS) network system – a tool that prevents the intrusion of network traffic that interferes with and monitors the network stack.The main function of the NIPS network is to protect groups of network hosts from possible attacks, analyze transmitted traffic, and block traffic related to attacks.

HIPS (Host-based IPS) host system – a host‑based intrusion prevention tool located on a specific host that protects it from malicious influences by analyzing network traffic, application behavior, system calls, and so on.

IPS also protects against distributed denial‑of‑service attacks.

Nowadays many defenses combine detection and blocking of attacks, which is why they are sometimes called IDS/IPS products.

However, using only IPS tools is not sufficient for effective protection – it is usually advisable to proactively identify the vulnerabilities, called holes, in corporate information systems (CIS) that attackers could exploit to successfully carry out an attack. These holes can be weak passwords, misconfigurations of network device settings, vulnerabilities in operating systems and applications, and so on.

36 of 56

37 of 56

Special tools—vulnerability scanners—are available for searching and identifying such vulnerabilities (Security assessment). Their use in corporate information systems significantly increases the level of protection: by identifying weak points, security staff can take appropriate measures to eliminate them before attackers can exploit them. Recently, specialized tools that provide an automated process for mitigating vulnerabilities have begun to appear, but so far only a few vendors offer such solutions.

To minimize the risk of the negative impact of attacks, IPS tools, vulnerability scanners, and mitigation tools need to be integrated into a single small system with centralized management.

Access prevention solution sensors, one or more management servers, vulnerability scanners, remediation tools, operator and administrator consoles.

38 of 56

Access prevention system for corporate information systems

39 of 56

Detecting IPS intrusion

 

In the process of detecting intrusion, the following methods of analyzing events are used:

  • Detection of abnormal (anomalous) behavior where abnormal events are identified (Anomaly-based);
  • Detection of unauthorized use based on signatures, where an event or set of events is examined against a predefined pattern (template) that describes a known attack. The form of a known attack is called a signature.

40 of 56

Detection of Abnormal (Anomalous) Behaviors

 

The technology for detecting attacks by identifying anomalous behavior is based on the following hypothesis. A user's abnormal actions (i.e., an attack or some hostile activity) often manifest as a deviation from normal behavior. Access attempt events differ from typical user activity or interactions of household members, and therefore can be detected.

Examples of abnormal behaviors include a very large number of connections within a short period, excessive use of the processor, etc. Sensors collect event data, build models of normal activity, and use various indicators to detect anomalies.

If it is possible to precisely define the profile of typical user behavior, then any deviation can be identified as an anomalous behavior. However, abnormal behaviors are not always attacks. For example, sending many requests to the network infrastructure simultaneously may be detected by the intrusion detection mechanism as a means of rejecting an attack.

41 of 56

42 of 56

Configuring and exploiting operating systems in this category, administrators encounter the following problems:

  • Creating a user profile is a difficult and time‑consuming task, requiring a lot of initial work from the administrator;
  • To reduce the likelihood of one of the two severe scenarios above occurring, determine the boundary values of user behavior characteristic attributes.

Anomaly detection technology is aimed at identifying new types of attacks. However, its drawback is the need for continuous training. So far, anomaly detection technology has not been widely adopted. This is because applying this technology in practice is difficult. Nevertheless, there is now a certain interest in it.

43 of 56

Detecting abuse

 The essence of another approach aimed at detecting attacks—detecting abuse—is to describe the attack in the form of a signature and search for this signature in a controllable field (network traffic or log).

It should be emphasized that reliably detecting the fact of an attack is not sufficient by merely finding a particular movement pattern or signature. For successful attack detection, a modern IPS must have the following features and functions:

  • using knowledge about the protected network topology;
  • analyzing interaction sessions taking into account the protocols used for data transmission;
  • reassembling fragmented IR packets before analyzing them, without checking the fragments of IR diagrams for continuity;
  • creating overlapping parts of IR diagrams, rewriting the composition of TCR segments, and controlling attempts to prevent them;
  • ensuring verification of the logical/format compliance of the protocol with the RFC;
  • performing statistical analysis of data;
  • supporting mechanisms for signature searching;
  • having learning and self‑learning capabilities.

In addition, because an IPS can decide to block traffic, reliable and secure remote management of the IPS must be ensured.

44 of 56

45 of 56

Preventing access to corporate information systems

 

The intrusion detection and prevention system (IPS) includes the following functions:

  • Preventing inbound access at the system (host) level;
  • Preventing inbound access at the network layer;
  • Protection against DDoS attacks;

Preventing entry to the system surface

 

HIPS (Host-based IPS) prevention tools operate at the information‑node level. The HIPS sub‑system quickly blocks attacks at the system level and notifies responsible persons.

HIPS system's (host) access prevention tools can be installed on a workstation or server. Additionally, host level IPS can be implemented in several ways:

  • In the form of a DT installed on the OS. Currently all solutions are limited to UNIX family operating systems;
  • When installed as a DT on a workstation at the upper layer of the OS. Many vendors produce: Cisco Systems, ISS, McAfee, Star Force, etc. IPS also has additional functions that include: controlling USB access, creating a locked software environment, monitoringdata exfiltration, managing the loading of external devices and other functions;
  • IPS can be a small subsystem implemented on a network interface card to mitigate specific attacks. Some manufacturers (specifically, D-Link) produce such devices, but their prevalence is not high

46 of 56

47 of 56

Preventing access to the network perimeter

 

The NIPS (Network-based IPS) intrusion prevention subsystem provides immediate blockage of network attacks and ensures that responsible persons are notified.

Detection of an attack is performed by comparing the bit sequence of the transmitted data stream with the corresponding attack signature, or by analyzing suspicious (abnormal) network activity through network traffic or violations of security policy rules. If attack attempts are detected, countermeasures are applied.

The following countermeasures may be implemented:

  • to block selected network packets;
  • to modify the configuration of other information security subsystems (e.g., TE) to prevent intrusion;
  • to retain selected packets for further analysis;
  • to log events and notify responsible persons.

48 of 56

IPS can be implemented at the network layer as follows:

  • Special devices (Security Appliances) that can be installed on the corporate network perimeter and, in some cases, inside it. These devices are the most common option. The main manufacturers of such tools are Cisco Systems, ISS, Juniper, 3Com, McAfee, and others;
  • Solutions integrated into the corporate network infrastructure.
  • Solutions integrated with the infrastructure are much more efficient than separate additional devices:
  • The price of an integrated solution is lower than that of an independent device;
  • The cost (financial and time) of implementing such a solution is also lower – there is no need to change the network topology;
  • Reliability is higher because there is no extra link in the transport flow chain that could fail;
  • Integrated solutions provide a higher level of protection by being in closer contact with protected resources.

49 of 56

Cisco Systems network layer access prevention scheme based on Cisco Systems products

50 of 56

Comparative characteristics of Network IPS and Host IPS subsystems

Advantages

Disadvantages

Network IPS

Broad application scope – the entire network can be covered with a single network sensor. Minimal inconvenience when updating signatures and installing sensor firmware updates. Prevention of DoS attacks. Ability to detect network‑layer errors in the TCR/IR set. Independence of information nodes from the operating system.

Along with real detections, false positives also occur. Encrypted data streams cannot be analyzed. If there is no signature for a particular attack, new types or variants of attacks will not be detected. Delay in detection and alert (signal) generation. Analyzing packets is difficult when the network is congested. No notification about successful attack execution.

Host IPS

Ability to associate the user with the event. Can detect attacks that NIDS sensors miss. Can analyze encrypted data on the host. Ability to provide information about the host during an attack.

To protect multiple hosts, sensors must be installed on each of them. If the operating system is compromised as a result of an attack, the sensor installed on that host will also cease to function. The sensor cannot detect activity of network browsers. Sensors may be ineffective when attacking a DoS target. Additional resources are required for operation.

51 of 56

52 of 56

DDoS – attack protection

 

One of the most important classes of computer attacks, in terms of consequences, is the “Denial of Service” (DDoS) attacks aimed at disrupting the availability of information resources.

The general approach to protecting against DDoS attacks includes implementing the following mechanisms:

  • Detect traffic;
  • Identify the source of the attack;
  • Prevent intrusion.

DDoS enterprise protection system. This solution requires a comprehensive approach to create a protection system capable of defending not only the individual servers of the enterprise but also the communication channels with the relevant network operators.

Implementing the solution enables the enhancement of security for the corporate network, routers, communication channels, email, web, and DNS servers.

Deploying such a protection system is appropriate in the following cases:

  • companies that conduct their business over the Internet;
  • the presence of a corporate website of the company;
  • use of the Internet to carry out business processes.

53 of 56

54 of 56

DoS – attack (Denial of Service) – this is an attack that disrupts the operation of a server or personal computer due to a large number of requests arriving at high speed to the targeted resource.

DDoS – attack (Distributed Denial of Service) – this is a type of DoS attack organized using a very large number of computers, so it can assault servers even when Internet channels have a very high bandwidth.

55 of 56

Kaspersky DDoS Prevention Service

 

One of the most effective solutions for mitigating DDoS attacks is the Kaspersky DDoS Prevention Service offered by Kaspersky Lab.

To detect malicious traffic during an attack, the Kaspersky DDoS system, among other things, uses the following set of criteria for traffic filtering:

  • static: based on black and white lists, including lists generated by user applications via API;
  • statistical: based on analyzing deviations of traffic statistical parameters from average values;
  • behavioral: based on analysis of compliance or non‑compliance with application protocol specifications;
  • signature‑based: based on analyzing the individual characteristics of bot actions, among others.

56 of 56

Types of virus threats

  1. DDoS attacks
  2. MAC flooding
  3. USB flash
  4. DNS subdomain substitution
  5. Trojan horse (Spyware)
  6. SPAM
  7. Scam
  8. IM (Instant Messaging
  9. Attacks via WEB servers
  10. Password cracker
  11. Remote administration tools
  12. Dialer
  13. Rootkit
  14. Targeted attacks