PLAN:
14-lecture. Detecting and mitigating attacks
There are programs created to attack someone's computer, delete data on that computer, steal someone's information, and use someone's resources without permission.
Attack detection - this is the process of detecting attempts to compromise the confidentiality, integrity, and access breach attempts.
Preventing intrusion - this is the process of blocking detected intrusions. Previously, only two security layers were installed around the network - firewall and intrusion detection system (IDS- Intrusion Detection System) detection systems.
Intrusion detection system - this designed to log suspicious activities on the network and send notifications to the management console, email messages, SMS messages to a mobile phone, etc., to notify the staff responsible for information security.
Firewalls (FW) pass traffic themselves but do not inspect the transmitted data; they only analyze IP packet headers. In contrast, IDS systems analyze the data that passes through the firewall but cannot block attacks because no traffic passes through them. Where these two technologies intersect, a new class of security tools emerged – the Intrusion Prevention System (IPS) – a system that prevents intrusion.
Attack detection and prevention
The Intrusion Prevention System (IPS) is designed to ensure the safety of protected objects against attacks that are recognized as attempts to infiltrate the IR.
IPS systems have become so popular that some manufacturers have begun advertising their IDS as intrusion prevention systems, i.e., IPS, thereby undeservedly opening new markets and attracting new customers.
In fact, IPS systems are far superior to IDS intrusion detection systems. IPS systems combine a variety of security technologies and are much more advanced than their predecessors, the IDS intrusion detection systems.
Key concepts
Intrusion detection and prevention tools (IPS) automate these processes and are crucial for preventing damage and losses caused by attacks at any organizational level. Unlike IDS, the true characteristics of an IPS are as follows:
The IPS operates in inline mode at line speed (it passes traffic through itself). In other words, the IPS solution does not reduce data throughput;
The IPS ensures that transmitted packets are assembled in the correct order and analyzes these packets to detect traces of unauthorized activity.
During analysis, various attack detection methods are employed—signature-based and behavior-based techniques, as well as anomaly detection in protocols;
The IPS is capable of blocking malicious traffic.
Thus, converting an IDS to an IPS is not just a matter of swapping a single letter in the name; it requires altering the solution's principles by incorporating new technologies.
When considering IPS, the classification inherited from intrusion detection systems is applied.
NIPS (Network-based IPS) network system – a tool that prevents the intrusion of network traffic that interferes with and monitors the network stack.The main function of the NIPS network is to protect groups of network hosts from possible attacks, analyze transmitted traffic, and block traffic related to attacks.
HIPS (Host-based IPS) host system – a host‑based intrusion prevention tool located on a specific host that protects it from malicious influences by analyzing network traffic, application behavior, system calls, and so on.
IPS also protects against distributed denial‑of‑service attacks.
Nowadays many defenses combine detection and blocking of attacks, which is why they are sometimes called IDS/IPS products.
However, using only IPS tools is not sufficient for effective protection – it is usually advisable to proactively identify the vulnerabilities, called holes, in corporate information systems (CIS) that attackers could exploit to successfully carry out an attack. These holes can be weak passwords, misconfigurations of network device settings, vulnerabilities in operating systems and applications, and so on.
Special tools—vulnerability scanners—are available for searching and identifying such vulnerabilities (Security assessment). Their use in corporate information systems significantly increases the level of protection: by identifying weak points, security staff can take appropriate measures to eliminate them before attackers can exploit them. Recently, specialized tools that provide an automated process for mitigating vulnerabilities have begun to appear, but so far only a few vendors offer such solutions.
To minimize the risk of the negative impact of attacks, IPS tools, vulnerability scanners, and mitigation tools need to be integrated into a single small system with centralized management.
Access prevention solution sensors, one or more management servers, vulnerability scanners, remediation tools, operator and administrator consoles.
Access prevention system for corporate information systems
Detecting IPS intrusion
In the process of detecting intrusion, the following methods of analyzing events are used:
Detection of Abnormal (Anomalous) Behaviors
The technology for detecting attacks by identifying anomalous behavior is based on the following hypothesis. A user's abnormal actions (i.e., an attack or some hostile activity) often manifest as a deviation from normal behavior. Access attempt events differ from typical user activity or interactions of household members, and therefore can be detected.
Examples of abnormal behaviors include a very large number of connections within a short period, excessive use of the processor, etc. Sensors collect event data, build models of normal activity, and use various indicators to detect anomalies.
If it is possible to precisely define the profile of typical user behavior, then any deviation can be identified as an anomalous behavior. However, abnormal behaviors are not always attacks. For example, sending many requests to the network infrastructure simultaneously may be detected by the intrusion detection mechanism as a means of rejecting an attack.
Configuring and exploiting operating systems in this category, administrators encounter the following problems:
Anomaly detection technology is aimed at identifying new types of attacks. However, its drawback is the need for continuous training. So far, anomaly detection technology has not been widely adopted. This is because applying this technology in practice is difficult. Nevertheless, there is now a certain interest in it.
Detecting abuse
The essence of another approach aimed at detecting attacks—detecting abuse—is to describe the attack in the form of a signature and search for this signature in a controllable field (network traffic or log).
It should be emphasized that reliably detecting the fact of an attack is not sufficient by merely finding a particular movement pattern or signature. For successful attack detection, a modern IPS must have the following features and functions:
In addition, because an IPS can decide to block traffic, reliable and secure remote management of the IPS must be ensured.
Preventing access to corporate information systems
The intrusion detection and prevention system (IPS) includes the following functions:
Preventing entry to the system surface
HIPS (Host-based IPS) prevention tools operate at the information‑node level. The HIPS sub‑system quickly blocks attacks at the system level and notifies responsible persons.
HIPS system's (host) access prevention tools can be installed on a workstation or server. Additionally, host level IPS can be implemented in several ways:
Preventing access to the network perimeter
The NIPS (Network-based IPS) intrusion prevention subsystem provides immediate blockage of network attacks and ensures that responsible persons are notified.
Detection of an attack is performed by comparing the bit sequence of the transmitted data stream with the corresponding attack signature, or by analyzing suspicious (abnormal) network activity through network traffic or violations of security policy rules. If attack attempts are detected, countermeasures are applied.
The following countermeasures may be implemented:
IPS can be implemented at the network layer as follows:
Cisco Systems network layer access prevention scheme based on Cisco Systems products
Comparative characteristics of Network IPS and Host IPS subsystems
Advantages | Disadvantages |
Network IPS | |
Broad application scope – the entire network can be covered with a single network sensor. Minimal inconvenience when updating signatures and installing sensor firmware updates. Prevention of DoS attacks. Ability to detect network‑layer errors in the TCR/IR set. Independence of information nodes from the operating system. | Along with real detections, false positives also occur. Encrypted data streams cannot be analyzed. If there is no signature for a particular attack, new types or variants of attacks will not be detected. Delay in detection and alert (signal) generation. Analyzing packets is difficult when the network is congested. No notification about successful attack execution. |
Host IPS | |
Ability to associate the user with the event. Can detect attacks that NIDS sensors miss. Can analyze encrypted data on the host. Ability to provide information about the host during an attack. | To protect multiple hosts, sensors must be installed on each of them. If the operating system is compromised as a result of an attack, the sensor installed on that host will also cease to function. The sensor cannot detect activity of network browsers. Sensors may be ineffective when attacking a DoS target. Additional resources are required for operation. |
DDoS – attack protection
One of the most important classes of computer attacks, in terms of consequences, is the “Denial of Service” (DDoS) attacks aimed at disrupting the availability of information resources.
The general approach to protecting against DDoS attacks includes implementing the following mechanisms:
DDoS enterprise protection system. This solution requires a comprehensive approach to create a protection system capable of defending not only the individual servers of the enterprise but also the communication channels with the relevant network operators.
Implementing the solution enables the enhancement of security for the corporate network, routers, communication channels, email, web, and DNS servers.
Deploying such a protection system is appropriate in the following cases:
DoS – attack (Denial of Service) – this is an attack that disrupts the operation of a server or personal computer due to a large number of requests arriving at high speed to the targeted resource.
DDoS – attack (Distributed Denial of Service) – this is a type of DoS attack organized using a very large number of computers, so it can assault servers even when Internet channels have a very high bandwidth.
Kaspersky DDoS Prevention Service
One of the most effective solutions for mitigating DDoS attacks is the Kaspersky DDoS Prevention Service offered by Kaspersky Lab.
To detect malicious traffic during an attack, the Kaspersky DDoS system, among other things, uses the following set of criteria for traffic filtering:
Types of virus threats
PLAN:
14-lecture. Detecting and mitigating attacks
There are programs created to attack someone's computer, delete data on that computer, steal someone's information, and use someone's resources without permission.
Attack detection - this is the process of detecting attempts to compromise the confidentiality, integrity, and access breach attempts.
Preventing intrusion - this is the process of blocking detected intrusions. Previously, only two security layers were installed around the network - firewall and intrusion detection system (IDS- Intrusion Detection System) detection systems.
Intrusion detection system - this designed to log suspicious activities on the network and send notifications to the management console, email messages, SMS messages to a mobile phone, etc., to notify the staff responsible for information security.
Firewalls (FW) pass traffic themselves but do not inspect the transmitted data; they only analyze IP packet headers. In contrast, IDS systems analyze the data that passes through the firewall but cannot block attacks because no traffic passes through them. Where these two technologies intersect, a new class of security tools emerged – the Intrusion Prevention System (IPS) – a system that prevents intrusion.
Attack detection and prevention
The Intrusion Prevention System (IPS) is designed to ensure the safety of protected objects against attacks that are recognized as attempts to infiltrate the IR.
IPS systems have become so popular that some manufacturers have begun advertising their IDS as intrusion prevention systems, i.e., IPS, thereby undeservedly opening new markets and attracting new customers.
In fact, IPS systems are far superior to IDS intrusion detection systems. IPS systems combine a variety of security technologies and are much more advanced than their predecessors, the IDS intrusion detection systems.
Key concepts
Intrusion detection and prevention tools (IPS) automate these processes and are crucial for preventing damage and losses caused by attacks at any organizational level. Unlike IDS, the true characteristics of an IPS are as follows:
The IPS operates in inline mode at line speed (it passes traffic through itself). In other words, the IPS solution does not reduce data throughput;
The IPS ensures that transmitted packets are assembled in the correct order and analyzes these packets to detect traces of unauthorized activity.
During analysis, various attack detection methods are employed—signature-based and behavior-based techniques, as well as anomaly detection in protocols;
The IPS is capable of blocking malicious traffic.
Thus, converting an IDS to an IPS is not just a matter of swapping a single letter in the name; it requires altering the solution's principles by incorporating new technologies.
When considering IPS, the classification inherited from intrusion detection systems is applied.
NIPS (Network-based IPS) network system – a tool that prevents the intrusion of network traffic that interferes with and monitors the network stack.The main function of the NIPS network is to protect groups of network hosts from possible attacks, analyze transmitted traffic, and block traffic related to attacks.
HIPS (Host-based IPS) host system – a host‑based intrusion prevention tool located on a specific host that protects it from malicious influences by analyzing network traffic, application behavior, system calls, and so on.
IPS also protects against distributed denial‑of‑service attacks.
Nowadays many defenses combine detection and blocking of attacks, which is why they are sometimes called IDS/IPS products.
However, using only IPS tools is not sufficient for effective protection – it is usually advisable to proactively identify the vulnerabilities, called holes, in corporate information systems (CIS) that attackers could exploit to successfully carry out an attack. These holes can be weak passwords, misconfigurations of network device settings, vulnerabilities in operating systems and applications, and so on.
Special tools—vulnerability scanners—are available for searching and identifying such vulnerabilities (Security assessment). Their use in corporate information systems significantly increases the level of protection: by identifying weak points, security staff can take appropriate measures to eliminate them before attackers can exploit them. Recently, specialized tools that provide an automated process for mitigating vulnerabilities have begun to appear, but so far only a few vendors offer such solutions.
To minimize the risk of the negative impact of attacks, IPS tools, vulnerability scanners, and mitigation tools need to be integrated into a single small system with centralized management.
Access prevention solution sensors, one or more management servers, vulnerability scanners, remediation tools, operator and administrator consoles.
Access prevention system for corporate information systems
Detecting IPS intrusion
In the process of detecting intrusion, the following methods of analyzing events are used:
Detection of Abnormal (Anomalous) Behaviors
The technology for detecting attacks by identifying anomalous behavior is based on the following hypothesis. A user's abnormal actions (i.e., an attack or some hostile activity) often manifest as a deviation from normal behavior. Access attempt events differ from typical user activity or interactions of household members, and therefore can be detected.
Examples of abnormal behaviors include a very large number of connections within a short period, excessive use of the processor, etc. Sensors collect event data, build models of normal activity, and use various indicators to detect anomalies.
If it is possible to precisely define the profile of typical user behavior, then any deviation can be identified as an anomalous behavior. However, abnormal behaviors are not always attacks. For example, sending many requests to the network infrastructure simultaneously may be detected by the intrusion detection mechanism as a means of rejecting an attack.
Configuring and exploiting operating systems in this category, administrators encounter the following problems:
Anomaly detection technology is aimed at identifying new types of attacks. However, its drawback is the need for continuous training. So far, anomaly detection technology has not been widely adopted. This is because applying this technology in practice is difficult. Nevertheless, there is now a certain interest in it.
Detecting abuse
The essence of another approach aimed at detecting attacks—detecting abuse—is to describe the attack in the form of a signature and search for this signature in a controllable field (network traffic or log).
It should be emphasized that reliably detecting the fact of an attack is not sufficient by merely finding a particular movement pattern or signature. For successful attack detection, a modern IPS must have the following features and functions:
In addition, because an IPS can decide to block traffic, reliable and secure remote management of the IPS must be ensured.
Preventing access to corporate information systems
The intrusion detection and prevention system (IPS) includes the following functions:
Preventing entry to the system surface
HIPS (Host-based IPS) prevention tools operate at the information‑node level. The HIPS sub‑system quickly blocks attacks at the system level and notifies responsible persons.
HIPS system's (host) access prevention tools can be installed on a workstation or server. Additionally, host level IPS can be implemented in several ways:
Preventing access to the network perimeter
The NIPS (Network-based IPS) intrusion prevention subsystem provides immediate blockage of network attacks and ensures that responsible persons are notified.
Detection of an attack is performed by comparing the bit sequence of the transmitted data stream with the corresponding attack signature, or by analyzing suspicious (abnormal) network activity through network traffic or violations of security policy rules. If attack attempts are detected, countermeasures are applied.
The following countermeasures may be implemented:
IPS can be implemented at the network layer as follows:
Cisco Systems network layer access prevention scheme based on Cisco Systems products
Comparative characteristics of Network IPS and Host IPS subsystems
Advantages | Disadvantages |
Network IPS | |
Broad application scope – the entire network can be covered with a single network sensor. Minimal inconvenience when updating signatures and installing sensor firmware updates. Prevention of DoS attacks. Ability to detect network‑layer errors in the TCR/IR set. Independence of information nodes from the operating system. | Along with real detections, false positives also occur. Encrypted data streams cannot be analyzed. If there is no signature for a particular attack, new types or variants of attacks will not be detected. Delay in detection and alert (signal) generation. Analyzing packets is difficult when the network is congested. No notification about successful attack execution. |
Host IPS | |
Ability to associate the user with the event. Can detect attacks that NIDS sensors miss. Can analyze encrypted data on the host. Ability to provide information about the host during an attack. | To protect multiple hosts, sensors must be installed on each of them. If the operating system is compromised as a result of an attack, the sensor installed on that host will also cease to function. The sensor cannot detect activity of network browsers. Sensors may be ineffective when attacking a DoS target. Additional resources are required for operation. |
DDoS – attack protection
One of the most important classes of computer attacks, in terms of consequences, is the “Denial of Service” (DDoS) attacks aimed at disrupting the availability of information resources.
The general approach to protecting against DDoS attacks includes implementing the following mechanisms:
DDoS enterprise protection system. This solution requires a comprehensive approach to create a protection system capable of defending not only the individual servers of the enterprise but also the communication channels with the relevant network operators.
Implementing the solution enables the enhancement of security for the corporate network, routers, communication channels, email, web, and DNS servers.
Deploying such a protection system is appropriate in the following cases:
DoS – attack (Denial of Service) – this is an attack that disrupts the operation of a server or personal computer due to a large number of requests arriving at high speed to the targeted resource.
DDoS – attack (Distributed Denial of Service) – this is a type of DoS attack organized using a very large number of computers, so it can assault servers even when Internet channels have a very high bandwidth.
Kaspersky DDoS Prevention Service
One of the most effective solutions for mitigating DDoS attacks is the Kaspersky DDoS Prevention Service offered by Kaspersky Lab.
To detect malicious traffic during an attack, the Kaspersky DDoS system, among other things, uses the following set of criteria for traffic filtering:
Types of virus threats