Network Security Incident Analysis System for Detecting Large-scale Internet Attacks
|
|
|
- Kelley Lynch
- 9 years ago
- Views:
Transcription
1 Network Security Incident Analysis System for Detecting Large-scale Internet Attacks Dr. Kenji Rikitake Security Advancement Group NICT, Japan September 6, 2005
2 Our goals Collaborative monitoring, centralized network security incident analysis and handling among Japanese Internet Service Providers (ISPs), including: real-time analysis for early-warning trends in-depth analysis for detecting new threats recommendation to the ISPs and users Protecting National IT infrastructure 6-SEP-2005 APEC-OECD Joint WG 2
3 Our partners Telecom-ISAC Japan Wide-area monitoring with probes on ISPs Incident handling with contingency plans Clearing house of incident info for ISPs Internet Security research communities Academic network administrators Virus and malware analysis experts Datamining and statistics experts 6-SEP-2005 APEC-OECD Joint WG 3
4 Our project and Telecom-ISAC Reports to the gov t and general users Recommendations to the member ISPs Telecom-ISAC Japan Operation Center Incident handling system Incident-information dissemination via Web Operators Wide-area monitoring system for the ISPs ISPs probes probes probes Integrated database for analyzed data and incidents In-depth analysis system (for long-term and detailed analysis with human experts) Real-time analysis system (of primary short-term statistic analysis and incident detection) Analysis experts Incident Analysis Center (operated by NICT) Honeypot networks Blackhole networks Academic network probes Traffic statistics from partner ISPs and networks Partner networks and sensor systems 6-SEP-2005 APEC-OECD Joint WG 4
5 Roles of our analysis center Real-time monitoring from various kinds of network providers from various types of information sources for detecting precursors ASAP Real-time (automated) analysis In-depth analysis (with the experts) Archiving events for future analyses 6-SEP-2005 APEC-OECD Joint WG 5
6 Required functions (1/2) Flow control and synchronization of different types of monitored data of different time resolutions and frames Parallel analysis of multiple algorithms for finding out clues of new incident trends such as virus or DDoS attack breakouts Visualization by multiple methods for helping the experts to find anomalies 6-SEP-2005 APEC-OECD Joint WG 6
7 Required functions (2/2) Large-scale incident database storage for archiving massive (tera-to-petabyte) amount of incident-related data for fast retrieval by the experts and the indepth analyzing tools for storing non-realtime large statistic data Workbench for in-depth analysis behavioral analysis of quarantined viruses 6-SEP-2005 APEC-OECD Joint WG 7
8 Configuration schematics of the Incident Analysis System Output for visualization, reporting, and recommendation Online Monitored Data Flow Control and Synchronization Large-scale Incident Database Offline Monitored Data Real-time Analysis Process A Real-time Analysis Process B In-depth Analysis Process X In-depth Analysis Process Y Monitoring Process Incident Analysis Experts 6-SEP-2005 APEC-OECD Joint WG 8
9 Monitoring networks and the probes Monitoring methods Capturing packets (raw and digested) Blackhole networks responding only to ICMP echo requests no actual hosts only attack packets coming TCP first-client-packet monitor sending a dummy ACK to a SYN request Effective to obtain HTTP methods for attacks Traffic/alert logs (syslog, IDS logs) 6-SEP-2005 APEC-OECD Joint WG 9
10 A real-time analysis method example: change-point detection Detecting timing of rapid change of a time-variant data flow Faster than repetitive statistical testings - Fast real-time learning - Adaptive to long-term change Detection Score - Fast detection - Low false-alarm rate - Applicable to DDoS by detecting rapid quantitative change of traffics Change Point Data flow Time 6-SEP-2005 APEC-OECD Joint WG 10
11 A change-point analysis example MS Blaster activities detected 12/AUG/2004 5am JST 18/AUG/2004 1pm JST Change-point score Number of dropped packets for TCP Port 135 time Analysis data provided by NEC 6-SEP-2005 APEC-OECD Joint WG 11
12 Other candidate algorithms for the real-time traffic analysis Rare-ratio analysis determining how rare an event is, by using the standard/gaussian distribution model Differential analysis comparing event rate difference between shortterm and long-term time frames Those analyses are effective for comparing logs of multiple IDSes of different network traffic characteristics 6-SEP-2005 APEC-OECD Joint WG 12
13 An example of in-depth analysis: DDoS attacks on a well-known site The virus generates simultaneous HTTP requests on specific days of month The attacked site can no longer serve normal HTTP requests In-depth analysis performed by our engineers Using actual traffics captured at the victim server With cooperation of Telecom-ISAC and OCN (ISP of NTT in Japan) twice on August 2004 and August SEP-2005 APEC-OECD Joint WG 13
14 In-depth DDoS analysis summary (1/2) Preprocessing per-minute log of captured data making digests of per-minute logs discarding unrelated payload contents preserving necessary data for analysis reducing the amount of data to process making access history of hosts for each IP source address 6-SEP-2005 APEC-OECD Joint WG 14
15 In-depth DDoS analysis summary (2/2) Making per-host attack activity ranking based on the history of each host using numbers of transmitted bytes, packets, HTTP requests, and session connection time Profiling based on HTTP methods per-hour summary for each method sent Passive operating system estimation using TCP signatures (p0f) 6-SEP-2005 APEC-OECD Joint WG 15
16 Digested log values and fields of each DDoS attacking packets + TCP -UNIX time() value -Packet length - Source IP address - Destination IP address -IP header flags - TCP header length - T for identifying TCP - Source port number - Destination port number - Sequence number - Ack number -TCP flags -TCP payload length - HTTP method (if existed) + UDP -UNIX time() value - Source IP address - Destination IP address -IP header flags - U for identifying UDP - Source port number - Destination port number -UDP payload length + ICMP -UNIX time() value - Source IP address - Destination IP address -IP header flags - I for identifying ICMP -Type -Code - ICMP payload length 6-SEP-2005 APEC-OECD Joint WG 16
17 DDoS activity of July 31, GET / HTTP/1.1 GET / HTTP/1.0 GET HTTP/1.1 climbing up POST / HTTP/1.1 POST / HTTP/1.0 POST /cgi-bin/.. HTTP/ POST /cgi-bin/.. HTTP/ :32:00 15:51:00 16:10:00 16:29:00 16:48:00 17:07:00 17:26:00 17:45:00 18:04:00 18:23:00 18:42:00 19:01:00 19:20:00 19:39:00 19:58:00 20:17:00 20:36:00 20:55:00 21:14:00 21:33:00 21:52:00 22:11:00 22:30:00 22:49:00 23:08:00 23:27:00 23:46:00 Numbers of packets Time in JST 6-SEP-2005 APEC-OECD Joint WG 17
18 DDoS activity of August 1, :00:00 0:46:00 1:32:00 2:18:00 3:04:00 3:50:00 4:36:00 5:22:00 6:08:00 6:54:00 7:40:00 8:26:00 9:12:00 9:58:00 10:44:00 11:30:00 12:16:00 13:02:00 13:48:00 14:34:00 15:20:00 16:06:00 16:52:00 17:38:00 18:24:00 19:10:00 19:56:00 20:42:00 21:28:00 22:14:00 23:00:00 23:46:00 GET / HTTP/1.1 traffic jumped up POST /cgi-bin/... HTTP/1.1 traffic slightly decreased GET / HTTP/1.0 has a similar pattern to GET / HTTP/1.1 GET / HTTP/1.1 GET / HTTP/1.0 POST / HTTP/1.1 POST / HTTP/1.0 POST /cgi-bin/.. HTTP/1.1 POST /cgi-bin/.. HTTP/1.0 Time in JST 6-SEP-2005 APEC-OECD Joint WG 18 Numbers of packets
19 DDoS activity of August 2, GET / HTTP/1.1 back to previous amount of traffic GET / HTTP/ 1.1 GET / HTTP/ 1.0 POST / HTTP/ 1.1 POST / HTTP/ 1.0 POST /cgi-bin/.. HTTP/1.1 POST /cgi-bin/.. HTTP/1.0 POST /cgi-bin/... HTTP/1.1 remained almost the same GET / HTTP/1.0 reduced to almost zero after 7am 1 0:00:00 0:44:00 1:28:00 2:12:00 2:56:00 3:40:00 4:24:00 5:08:00 5:52:00 6:36:00 7:20:00 8:04:00 8:48:00 9:32:00 10:16:00 11:00:00 11:44:00 12:28:00 13:12:00 13:56:00 14:40:00 15:24:00 16:08:00 16:52:00 17:36:00 18:20:00 19:04:00 19:48:00 20:32:00 21:16:00 22:00:00 22:44:00 23:28:00 Time in JST 6-SEP-2005 APEC-OECD Joint WG 19 Number of packets
20 Operating systems estimated for the DDoS attacking hosts (The DDoS virus has been known as Windows-specific) Windows 2000 SP4, XP SP1 Windows 2000 SP2+, XP SP1 (seldom ) Windows XP Pro SP1, 2000 SP3 Windows XP Pro SP1, 2000 SP3 (NAT!) Windows XP/2000 [GENERIC] Windows 3.11 (Tucows) (firewall!) OpenBSD 3.0 {note: this is probably a Web proxy server OS} Windows XP/2000 (RFC1323 no tstamp) [GENERIC] Windows 2000 SP4, XP SP1 (firewall!) Windows XP (RFC1323, w+) [GENERIC] 6-SEP-2005 APEC-OECD Joint WG 20
![) Windows XP/2000 [GENERIC] Windows 3.11 (Tucows) (firewall!) OpenBSD 3.](/docs-images/49/18082356/images/page_20.jpg "0 {note: this is probably a Web proxy server OS} Windows XP/2000 (RFC1323 no tstamp) [GENERIC] Windows 2000 SP4, XP SP1")
21 Trends observed from the monitored DDoS activities Increased on the day 1 of the month two GET activities Steady traffics two POST HTTP/1.1 activities two POST HTTP/1.0 activities While the above three trend groups were the same as in 2004, detailed traffic time variance have been changed 6-SEP-2005 APEC-OECD Joint WG 21
22 Another candidate algorithms for in-depth analysis and visualization: self-organizing maps - SOMs are effective to detect similarities between diffrent datasets - The meaning of the resulting figures is non-trivial, though similar patterns for / and /cgi... POST methods similarity detected on incoming TCP packets and HTTP POST methods 6-SEP-2005 APEC-OECD Joint WG 22
23 Schedule and things to do Research towards data integration needed More expertise and research works needed to understand the relationship between data trends and actual incidents happening on the networks More information sources needed We need to be careful on the legal requirements and rights of the network users (i.e., privacy of traffics) Schedule December 2005: 1st beta-version demo of Incident Analysis Center System Production-level operation on SEP-2005 APEC-OECD Joint WG 23
CIT 380: Securing Computer Systems
CIT 380: Securing Computer Systems Scanning CIT 380: Securing Computer Systems Slide #1 Topics 1. Port Scanning 2. Stealth Scanning 3. Version Identification 4. OS Fingerprinting 5. Vulnerability Scanning
Host Discovery with nmap
Host Discovery with nmap By: Mark Wolfgang [email protected] November 2002 Table of Contents Host Discovery with nmap... 1 1. Introduction... 3 1.1 What is Host Discovery?... 4 2. Exploring nmap s Default
CONFIGURING TCP/IP ADDRESSING AND SECURITY
1 Chapter 11 CONFIGURING TCP/IP ADDRESSING AND SECURITY Chapter 11: CONFIGURING TCP/IP ADDRESSING AND SECURITY 2 OVERVIEW Understand IP addressing Manage IP subnetting and subnet masks Understand IP security
Firewall Introduction Several Types of Firewall. Cisco PIX Firewall
Firewall Introduction Several Types of Firewall. Cisco PIX Firewall What is a Firewall? Non-computer industries: a wall that controls the spreading of a fire. Networks: a designed device that controls
Firewalls and Intrusion Detection
Firewalls and Intrusion Detection What is a Firewall? A computer system between the internal network and the rest of the Internet A single computer or a set of computers that cooperate to perform the firewall
Internet Firewall CSIS 4222. Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS 4222. net15 1. Routers can implement packet filtering
Internet Firewall CSIS 4222 A combination of hardware and software that isolates an organization s internal network from the Internet at large Ch 27: Internet Routing Ch 30: Packet filtering & firewalls
Analysis of a DDoS Attack
Analysis of a DDoS Attack December 2014 CONFIDENTIAL CORERO INTERNAL USE ONLY Methodology around DDoS Detection & Mitigation Corero methodology for DDoS protection Initial Configuration Monitoring and
Strategies to Protect Against Distributed Denial of Service (DD
Strategies to Protect Against Distributed Denial of Service (DD Table of Contents Strategies to Protect Against Distributed Denial of Service (DDoS) Attacks...1 Introduction...1 Understanding the Basics
Firewalls. Network Security. Firewalls Defined. Firewalls
Network Security Firewalls Firewalls Types of Firewalls Screening router firewalls Computer-based firewalls Firewall appliances Host firewalls (firewalls on clients and servers) Inspection Methods Firewall
Application of Netflow logs in Analysis and Detection of DDoS Attacks
International Journal of Computer and Internet Security. ISSN 0974-2247 Volume 8, Number 1 (2016), pp. 1-8 International Research Publication House http://www.irphouse.com Application of Netflow logs in
Intrusion Detection Systems
Intrusion Detection Systems Raj Jain Washington University in Saint Louis Saint Louis, MO 63130 [email protected] Audio/Video recordings of this lecture are available at: http://www.cse.wustl.edu/~jain/cse571-07/
Firewalls & Intrusion Detection
Firewalls & Intrusion Detection CS 594 Special Topics/Kent Law School: Computer and Network Privacy and Security: Ethical, Legal, and Technical Consideration 2007, 2008 Robert H. Sloan Security Intrusion
Intro to Firewalls. Summary
Topic 3: Lesson 2 Intro to Firewalls Summary Basic questions What is a firewall? What can a firewall do? What is packet filtering? What is proxying? What is stateful packet filtering? Compare network layer
CS5008: Internet Computing
CS5008: Internet Computing Lecture 22: Internet Security A. O Riordan, 2009, latest revision 2015 Internet Security When a computer connects to the Internet and begins communicating with others, it is
PROFESSIONAL SECURITY SYSTEMS
PROFESSIONAL SECURITY SYSTEMS Security policy, active protection against network attacks and management of IDP Introduction Intrusion Detection and Prevention (IDP ) is a new generation of network security
Firewalls. Ahmad Almulhem March 10, 2012
Firewalls Ahmad Almulhem March 10, 2012 1 Outline Firewalls The Need for Firewalls Firewall Characteristics Types of Firewalls Firewall Basing Firewall Configurations Firewall Policies and Anomalies 2
Introduction of Intrusion Detection Systems
Introduction of Intrusion Detection Systems Why IDS? Inspects all inbound and outbound network activity and identifies a network or system attack from someone attempting to compromise a system. Detection:
Guide to DDoS Attacks December 2014 Authored by: Lee Myers, SOC Analyst
INTEGRATED INTELLIGENCE CENTER Technical White Paper William F. Pelgrin, CIS President and CEO Guide to DDoS Attacks December 2014 Authored by: Lee Myers, SOC Analyst This Center for Internet Security
We will give some overview of firewalls. Figure 1 explains the position of a firewall. Figure 1: A Firewall
Chapter 10 Firewall Firewalls are devices used to protect a local network from network based security threats while at the same time affording access to the wide area network and the internet. Basically,
Chapter 15. Firewalls, IDS and IPS
Chapter 15 Firewalls, IDS and IPS Basic Firewall Operation The firewall is a border firewall. It sits at the boundary between the corporate site and the external Internet. A firewall examines each packet
Chapter 9 Firewalls and Intrusion Prevention Systems
Chapter 9 Firewalls and Intrusion Prevention Systems connectivity is essential However it creates a threat Effective means of protecting LANs Inserted between the premises network and the to establish
Network Based Intrusion Detection Using Honey pot Deception
Network Based Intrusion Detection Using Honey pot Deception Dr.K.V.Kulhalli, S.R.Khot Department of Electronics and Communication Engineering D.Y.Patil College of Engg.& technology, Kolhapur,Maharashtra,India.
Port Scanning. Objectives. Introduction: Port Scanning. 1. Introduce the techniques of port scanning. 2. Use port scanning audit tools such as Nmap.
Port Scanning Objectives 1. Introduce the techniques of port scanning. 2. Use port scanning audit tools such as Nmap. Introduction: All machines connected to a LAN or connected to Internet via a modem
Understanding Syslog Messages for the Barracuda Web Filter
Understanding Syslog Messages for the Barracuda Web Filter Overview This document describes each element of a syslog message so you can better analyze why your Barracuda Web Filter performs a particular
CSCI 4250/6250 Fall 2015 Computer and Networks Security
CSCI 4250/6250 Fall 2015 Computer and Networks Security Network Security Goodrich, Chapter 5-6 Tunnels } The contents of TCP packets are not normally encrypted, so if someone is eavesdropping on a TCP
Network Defense Tools
Network Defense Tools Prepared by Vanjara Ravikant Thakkarbhai Engineering College, Godhra-Tuwa +91-94291-77234 www.cebirds.in, www.facebook.com/cebirds [email protected] What is Firewall? A firewall
CYBER ATTACKS EXPLAINED: PACKET CRAFTING
CYBER ATTACKS EXPLAINED: PACKET CRAFTING Protect your FOSS-based IT infrastructure from packet crafting by learning more about it. In the previous articles in this series, we explored common infrastructure
Network Security. Tampere Seminar 23rd October 2008. Overview Switch Security Firewalls Conclusion
Network Security Tampere Seminar 23rd October 2008 1 Copyright 2008 Hirschmann 2008 Hirschmann Automation and and Control GmbH. Contents Overview Switch Security Firewalls Conclusion 2 Copyright 2008 Hirschmann
AlienVault Unified Security Management Solution Complete. Simple. Affordable Life Cycle of a log
Complete. Simple. Affordable Copyright 2014 AlienVault. All rights reserved. AlienVault, AlienVault Unified Security Management, AlienVault USM, AlienVault Open Threat Exchange, AlienVault OTX, Open Threat
Passive Network Traffic Analysis: Understanding a Network Through Passive Monitoring Kevin Timm,
Passive Network Traffic Analysis: Understanding a Network Through Passive Monitoring Kevin Timm, Network IDS devices use passive network monitoring extensively to detect possible threats. Through passive
Firewall Testing Methodology W H I T E P A P E R
Firewall ing W H I T E P A P E R Introduction With the deployment of application-aware firewalls, UTMs, and DPI engines, the network is becoming more intelligent at the application level With this awareness
FIREWALL AND NAT Lecture 7a
FIREWALL AND NAT Lecture 7a COMPSCI 726 Network Defence and Countermeasures Muhammad Rizwan Asghar August 3, 2015 Source of most of slides: University of Twente FIREWALL An integrated collection of security
Stateful Firewalls. Hank and Foo
Stateful Firewalls Hank and Foo 1 Types of firewalls Packet filter (stateless) Proxy firewalls Stateful inspection Deep packet inspection 2 Packet filter (Access Control Lists) Treats each packet in isolation
Flow Analysis. Make A Right Policy for Your Network. GenieNRM
Flow Analysis Make A Right Policy for Your Network GenieNRM Why Flow Analysis? Resolve Network Managers Challenge as follow: How can I know the Detail and Real-Time situation of my network? How can I do
Network Security TCP/IP Refresher
Network Security TCP/IP Refresher What you (at least) need to know about networking! Dr. David Barrera Network Security HS 2014 Outline Network Reference Models Local Area Networks Internet Protocol (IP)
RID-DoS: Real-time Inter-network Defense Against Denial of Service Attacks. Kathleen M. Moriarty. MIT Lincoln Laboratory.
: Real-time Inter-network Defense Against Denial of Service Attacks Kathleen M. Moriarty 22 October 2002 This work was sponsored by the Air Force Contract number F19628-00-C-002. Opinions, interpretations,
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention. Spring 2013
CS 356 Lecture 19 and 20 Firewalls and Intrusion Prevention Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access
Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003
http://technet.microsoft.com/en-us/library/cc757501(ws.10).aspx Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003 Updated: October 7, 2005 Applies To: Windows Server 2003 with
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant
Evading Infrastructure Security Mohamed Bedewi Penetration Testing Consultant What infrastructure security really means? Infrastructure Security is Making sure that your system services are always running
Cullen Jennings [email protected]. July 2015
Cullen Jennings [email protected] July 2015 v9 1 A B 1. Outbound STUN request to well known STUN port (3478) Firewall creates 3-tuple pinhole for incoming and outgoing STUN message with matching username
The SIEM Evaluator s Guide
Using SIEM for Compliance, Threat Management, & Incident Response Security information and event management (SIEM) tools are designed to collect, store, analyze, and report on log data for threat detection,
INTRODUCTION TO FIREWALL SECURITY
INTRODUCTION TO FIREWALL SECURITY SESSION 1 Agenda Introduction to Firewalls Types of Firewalls Modes and Deployments Key Features in a Firewall Emerging Trends 2 Printed in USA. What Is a Firewall DMZ
Firewall Defaults, Public Server Rule, and Secondary WAN IP Address
Firewall Defaults, Public Server Rule, and Secondary WAN IP Address This quick start guide provides the firewall defaults and explains how to configure some basic firewall rules for the ProSafe Wireless-N
Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP
Overview Securing TCP/IP Chapter 6 TCP/IP Open Systems Interconnection Model Anatomy of a Packet Internet Protocol Security (IPSec) Web Security (HTTP over TLS, Secure-HTTP) Lecturer: Pei-yih Ting 1 2
Firewalls. configuring a sophisticated GNU/Linux firewall involves understanding
Firewalls slide 1 configuring a sophisticated GNU/Linux firewall involves understanding iptables iptables is a package which interfaces to the Linux kernel and configures various rules for allowing packets
CSE331: Introduction to Networks and Security. Lecture 12 Fall 2006
CSE331: Introduction to Networks and Security Lecture 12 Fall 2006 Announcements Midterm I will be held Friday, Oct. 6th. True/False Multiple Choice Calculation Short answer Short essay Project 2 is on
CS 356 Lecture 16 Denial of Service. Spring 2013
CS 356 Lecture 16 Denial of Service Spring 2013 Review Chapter 1: Basic Concepts and Terminology Chapter 2: Basic Cryptographic Tools Chapter 3 User Authentication Chapter 4 Access Control Lists Chapter
Network- vs. Host-based Intrusion Detection
Network- vs. Host-based Intrusion Detection A Guide to Intrusion Detection Technology 6600 Peachtree-Dunwoody Road 300 Embassy Row Atlanta, GA 30348 Tel: 678.443.6000 Toll-free: 800.776.2362 Fax: 678.443.6477
NAT & IP Masquerade. Internet NETWORK ADDRESS TRANSLATION INTRODUCTION. NAT & IP Masquerade Page 1 of 5. Internal PC 192.168.0.25
NAT & IP Masquerade Page 1 of 5 INTRODUCTION Pre-requisites TCP/IP IP Address Space NAT & IP Masquerade Protocol version 4 uses a 32 bit IP address. In theory, a 32 bit address space should provide addresses
Cisco PIX vs. Checkpoint Firewall
Cisco PIX vs. Checkpoint Firewall Introduction Firewall technology ranges from packet filtering to application-layer proxies, to Stateful inspection; each technique gleaning the benefits from its predecessor.
Understanding Slow Start
Chapter 1 Load Balancing 57 Understanding Slow Start When you configure a NetScaler to use a metric-based LB method such as Least Connections, Least Response Time, Least Bandwidth, Least Packets, or Custom
Fuzzy Network Profiling for Intrusion Detection
Fuzzy Network Profiling for Intrusion Detection John E. Dickerson ([email protected]) and Julie A. Dickerson ([email protected]) Electrical and Computer Engineering Department Iowa State University
Firewalls. Chapter 3
Firewalls Chapter 3 1 Border Firewall Passed Packet (Ingress) Passed Packet (Egress) Attack Packet Hardened Client PC Internet (Not Trusted) Hardened Server Dropped Packet (Ingress) Log File Internet Border
Agenda. Taxonomy of Botnet Threats. Background. Summary. Background. Taxonomy. Trend Micro Inc. Presented by Tushar Ranka
Taxonomy of Botnet Threats Trend Micro Inc. Presented by Tushar Ranka Agenda Summary Background Taxonomy Attacking Behavior Command & Control Rallying Mechanisms Communication Protocols Evasion Techniques
Solution of Exercise Sheet 5
Foundations of Cybersecurity (Winter 15/16) Prof. Dr. Michael Backes CISPA / Saarland University saarland university computer science Protocols = {????} Client Server IP Address =???? IP Address =????
Stop that Big Hack Attack Protecting Your Network from Hackers. www.lauraknapp.com
Stop that Big Hack Attack Protecting Your Network from Hackers Laura Jeanne Knapp Technical Evangelist 1-919-224-2205 [email protected] www.lauraknapp.com NetSec_ 010 Agenda Components of security threats
20-CS-6053-00X Network Security Spring, 2014. An Introduction To. Network Security. Week 1. January 7
20-CS-6053-00X Network Security Spring, 2014 An Introduction To Network Security Week 1 January 7 Attacks Criminal: fraud, scams, destruction; IP, ID, brand theft Privacy: surveillance, databases, traffic
Chapter 3. TCP/IP Networks. 3.1 Internet Protocol version 4 (IPv4)
Chapter 3 TCP/IP Networks 3.1 Internet Protocol version 4 (IPv4) Internet Protocol version 4 is the fourth iteration of the Internet Protocol (IP) and it is the first version of the protocol to be widely
Wharf T&T Limited DDoS Mitigation Service Customer Portal User Guide
Table of Content I. Note... 1 II. Login... 1 III. Real-time, Daily and Monthly Report... 3 Part A: Real-time Report... 3 Part 1: Traffic Details... 4 Part 2: Protocol Details... 5 Part B: Daily Report...
WHITE PAPER. FortiGate DoS Protection Block Malicious Traffic Before It Affects Critical Applications and Systems
WHITE PAPER FortiGate DoS Protection Block Malicious Traffic Before It Affects Critical Applications and Systems Abstract: Denial of Service (DoS) attacks have been a part of the internet landscape for
Firewalls. Ingress Filtering. Ingress Filtering. Network Security. Firewalls. Access lists Ingress filtering. Egress filtering NAT
Network Security s Access lists Ingress filtering s Egress filtering NAT 2 Drivers of Performance RequirementsTraffic Volume and Complexity of Static IP Packet Filter Corporate Network The Complexity of
Network and Services Discovery
A quick theorical introduction to network scanning January 8, 2016 Disclaimer/Intro Disclaimer/Intro Network scanning is not exact science When an information system is able to interact over the network
Linux Network Security
Linux Network Security Course ID SEC220 Course Description This extremely popular class focuses on network security, and makes an excellent companion class to the GL550: Host Security course. Protocols
CSCE 465 Computer & Network Security
CSCE 465 Computer & Network Security Instructor: Dr. Guofei Gu http://courses.cse.tamu.edu/guofei/csce465/ Vulnerability Analysis 1 Roadmap Why vulnerability analysis? Example: TCP/IP related vulnerabilities
DDoS attacks on electronic payment systems. Sean Rijs and Joris Claassen Supervisor: Stefan Dusée
DDoS attacks on electronic payment systems Sean Rijs and Joris Claassen Supervisor: Stefan Dusée Scope High volume DDoS attacks Electronic payment systems Low bandwidth requirements: 5 from account X to
FIREWALLS & CBAC. [email protected]
FIREWALLS & CBAC [email protected] Implementing a Firewall Personal software firewall a software that is installed on a single PC to protect only that PC All-in-one firewall can be a single device that
Configuration Example
Configuration Example Set Up a Public Web Server Behind a Firebox Example configuration files created with WSM v11.10.1 Revised 7/21/2015 Use Case In this configuration example, an organization wants to
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump
Network forensics 101 Network monitoring with Netflow, nfsen + nfdump www.enisa.europa.eu Agenda Intro to netflow Metrics Toolbox (Nfsen + Nfdump) Demo www.enisa.europa.eu 2 What is Netflow Netflow = Netflow
NetFlow use cases. ICmyNet / NetVizura. Miloš Zeković, [email protected]. ICmyNet Chief Customer Officer Soneco d.o.o.
NetFlow use cases ICmyNet / NetVizura, [email protected] Soneco d.o.o. Serbia Agenda ICmyNet / NetVizura overview Use cases / case studies Statistics per exporter/interfaces Traffic Patterns NREN
Detection of illegal gateways in protected networks
Detection of illegal gateways in protected networks Risto Vaarandi and Kārlis Podiņš Cooperative Cyber Defence Centre of Excellence Tallinn, Estonia [email protected] 1. Introduction In this
Cisco IOS Flexible NetFlow Technology
Cisco IOS Flexible NetFlow Technology Last Updated: December 2008 The Challenge: The ability to characterize IP traffic and understand the origin, the traffic destination, the time of day, the application
Port Scanning and Vulnerability Assessment. ECE4893 Internetwork Security Georgia Institute of Technology
Port Scanning and Vulnerability Assessment ECE4893 Internetwork Security Georgia Institute of Technology Agenda Reconnaissance Scanning Network Mapping OS detection Vulnerability assessment Reconnaissance
Network/Internet Forensic and Intrusion Log Analysis
Course Introduction Enterprises all over the globe are compromised remotely by malicious hackers each day. Credit card numbers, proprietary information, account usernames and passwords, and a wealth of
Firewalls, Tunnels, and Network Intrusion Detection
Firewalls, Tunnels, and Network Intrusion Detection 1 Part 1: Firewall as a Technique to create a virtual security wall separating your organization from the wild west of the public internet 2 1 Firewalls
Fuzzy Network Profiling for Intrusion Detection
Fuzzy Network Profiling for Intrusion Detection John E. Dickerson ([email protected]) and Julie A. Dickerson ([email protected]) Electrical and Computer Engineering Department Iowa State University
Classic IOS Firewall using CBACs. 2012 Cisco and/or its affiliates. All rights reserved. 1
Classic IOS Firewall using CBACs 2012 Cisco and/or its affiliates. All rights reserved. 1 Although CBAC serves as a good foundation for understanding the revolutionary path toward modern zone based firewalls,
Network Security. Chapter 3. Cornelius Diekmann. Version: October 21, 2015. Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik
Network Security Chapter 3 Cornelius Diekmann Lehrstuhl für Netzarchitekturen und Netzdienste Institut für Informatik Version: October 21, 2015 IN2101, WS 15/16, Network Security 1 Security Policies and
+ iptables. packet filtering && firewall
+ iptables packet filtering && firewall + what is iptables? iptables is the userspace command line program used to configure the linux packet filtering ruleset + a.k.a. firewall + iptable flow chart what?
Large-Scale TCP Packet Flow Analysis for Common Protocols Using Apache Hadoop
Large-Scale TCP Packet Flow Analysis for Common Protocols Using Apache Hadoop R. David Idol Department of Computer Science University of North Carolina at Chapel Hill [email protected] http://www.cs.unc.edu/~mxrider
Lecture 23: Firewalls
Lecture 23: Firewalls Introduce several types of firewalls Discuss their advantages and disadvantages Compare their performances Demonstrate their applications C. Ding -- COMP581 -- L23 What is a Digital
Firewalls. Pehr Söderman KTH-CSC [email protected]
Firewalls Pehr Söderman KTH-CSC [email protected] 1 Definition A firewall is a network device that separates two parts of a network, enforcing a policy for all traversing traffic. 2 Fundamental requirements
FortiGate IPS Guide. Intrusion Prevention System Guide. Version 1.0 30 November 2004 01-28007-0080-20041130
FortiGate IPS Guide Intrusion Prevention System Guide Version 1.0 30 November 2004 01-28007-0080-20041130 Copyright 2004 Fortinet Inc. All rights reserved. No part of this publication including text, examples,
Network Forensics: Log Analysis
Network Forensics: Analysis Richard Baskerville Agenda P Terms & -based Tracing P Application Layer Analysis P Lower Layer Analysis Georgia State University 1 2 Two Important Terms PPromiscuous Mode
How To Stop A Ddos Attack On A Network From Tracing To Source From A Network To A Source Address
Inter-provider Coordination for Real-Time Tracebacks Kathleen M. Moriarty 2 June 2003 This work was sponsored by the Air Force Contract number F19628-00-C-002. Opinions, interpretations, conclusions, and
The server will respond to the client with a list of instances. One such attack was analyzed by an information security researcher in January 2015.
1 TLP: GREEN 02.11.15 GSI ID: 1086 SECURITY BULLETIN: MS SQL REFLECTION DDOS RISK FACTOR - MEDIUM 1.1 / OVERVIEW / Beginning in October 2014, PLXsert observed the use of a new type of reflection-based
Internet Security Firewalls
Overview Internet Security Firewalls Ozalp Babaoglu! Exo-structures " Firewalls " Virtual Private Networks! Cryptography-based technologies " IPSec " Secure Socket Layer ALMA MATER STUDIORUM UNIVERSITA
Symantec Event Collector 4.3 for Cisco PIX Quick Reference
Symantec Event Collector 4.3 for Cisco PIX Quick Reference Symantec Event Collector for Cisco PIX Quick Reference The software described in this book is furnished under a license agreement and may be used
Configuring Static and Dynamic NAT Simultaneously
Configuring Static and Dynamic NAT Simultaneously Document ID: 13778 Contents Introduction Prerequisites Requirements Components Used Conventions Configuring NAT Related Information Introduction In some
Intrusion Detection Systems (IDS)
Intrusion Detection Systems (IDS) What are They and How do They Work? By Wayne T Work Security Gauntlet Consulting 56 Applewood Lane Naugatuck, CT 06770 203.217.5004 Page 1 6/12/2003 1. Introduction Intrusion
Computer Security: Principles and Practice
Computer Security: Principles and Practice Chapter 9 Firewalls and Intrusion Prevention Systems First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Firewalls and Intrusion
Firewalls. Test your Firewall knowledge. Test your Firewall knowledge (cont) (March 4, 2015)
s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware
Firewalls, IDS and IPS
Session 9 Firewalls, IDS and IPS Prepared By: Dr. Mohamed Abd-Eldayem Ref.: Corporate Computer and Network Security By: Raymond Panko Basic Firewall Operation 2. Internet Border Firewall 1. Internet (Not
Voice over IP. Demonstration 1: VoIP Protocols. Network Environment
Voice over IP Demonstration 1: VoIP Protocols Network Environment We use two Windows workstations from the production network, both with OpenPhone application (figure 1). The OpenH.323 project has developed
Dos & DDoS Attack Signatures (note supplied by Steve Tonkovich of CAPTUS NETWORKS)
Dos & DDoS Attack Signatures (note supplied by Steve Tonkovich of CAPTUS NETWORKS) Signature based IDS systems use these fingerprints to verify that an attack is taking place. The problem with this method