How To Prevent Network Attacks

Transcription

1 Ali A. Ghorbani Wei Lu Mahbod Tavallaee Network Intrusion Detection and Prevention Concepts and Techniques )Spri inger

2 Contents 1 Network Attacks Attack Taxonomies Probes IPSweep and PortSweep NMap MScan SAINT Satan Privilege Escalation Attacks Buffer Overflow Attacks Misconfiguration Attacks Race-condition Attacks Man-in-the-Middle Attacks Social Engineering Attacks Denial of Service (DoS) and Distributed Denial of Service (DDoS) Attacks Detection Approaches for DoS and DDoS Attacks Prevention and Response for DoS and DDoS Attacks Examples of DoS and DDoS Attacks Worms Attacks Modeling and Analysis of Worm Behaviors Detection and Monitoring of Worm Attacks Worms Containment Examples of Well Known Worm Attacks Routing Attacks OSPF Attacks BGP Attacks 21 References 22 XV

3 xvi Contents 2 Detection Approaches Misuse Detection Pattern Matching Rule-based Techniques State-based Techniques Techniques based on Data Mining Anomaly Detection Advanced Statistical Models Rule based Techniques Biological Models Learning Models Specification-based Detection Hybrid Detection 46 References 49 3 Data Collection Data Collection for Host-Based IDSs Audit Logs System Call Sequences Data Collection for Network-Based IDSs SNMP Packets Limitations of Network-Based IDSs Data Collection for Application-Based IDSs Data Collection for Application-Integrated IDSs Hybrid Data Collection 69 References 69 4 Theoretical Foundation of Detection Taxonomy of Anomaly Detection Systems Fuzzy Logic Fuzzy Logic in Anomaly Detection Bayes Theory Naive Bayes Classifier Bayes Theory in Anomaly Detection Artificial Neural Networks Processing Elements Connections Network Architectures Learning Process Artificial Neural Networks in Anomaly Detection Support Vector Machine (SVM) Support Vector Machine in Anomaly Detection Evolutionary Computation Evolutionary Computation in Anomaly Detection 91

4 Contents xvii 4.7 Association Rules The Apriori Algorithm Association Rules in Anomaly Detection Clustering Taxonomy of Clustering Algorithms K-Means Clustering Y-Means Clustering Maximum-Likelihood Estimates Unsupervised Learning of Gaussian Data Clustering Based on Density Distribution Functions Clustering in Anomaly Detection Signal Processing Techniques Based Models Comparative Study of Anomaly Detection Techniques 109 References Architecture and Implementation Centralized Distributed Intelligent Agents Mobile Agents Cooperative Intrusion Detection 125 References Alert Management and Correlation Data Fusion Alert Correlation Preprocess Correlation Techniques Postprocess Alert Correlation Architectures Validation of Alert Correlation Systems Cooperative Intrusion Detection Basic Principles of Information Sharing Cooperation Based on Goal-tree Representation of Attack Strategies Cooperative Discovery of Intrusion Chain Abstraction-Based Intrusion Detection Interest-Based Communication and Cooperation Agent-Based Cooperation Secure Communication Using Public-key Encryption 157 References 157

5 xviii Contents 7 Evaluation Criteria Accuracy False Positive and Negative Confusion Matrix Precision, Recall, and F-Measure ROC Curves The Base-Rate Fallacy Performance Completeness Timely Response Adaptation and Cost-Sensitivity Intrusion Tolerance and Attack Resistance Redundant and Fault Tolerance Design Obstructing Methods Test, Evaluation and Data Sets 180 References Intrusion Response Response Type Passive Alerting and Manual Response Active Response Response Approach Decision Analysis Control Theory Game theory Fuzzy theory Survivability and Intrusion Tolerance 194 References 197 A Examples of Commercial and Open Source IDSs 199 A.l Bro Intrusion Detection System 199 A.2 Prelude Intrusion Detection System 199 A.3 Snort Intrusion Detection System 200 A.4 Ethereal Application - Network Protocol Analyzer 200 A.5 Multi Router Traffic Grapher (MRTG) 201 A.6 Tamandua Network Intrusion Detection System 202 A.7 Other Commercial IDSs 202 Index 209