IDS Flashcards
What is IDS?
“Intrusion Detection System”
Can be seen as the networks anti-virus.
Looks at every bit of data that goes into the network
What are the 4 IDS Objectives
- Detect a variety of intrusions
- Analysis in a simple, easy-to-understand format
- Detection in timely fashion (within short period of time)
- Be accurate (False positives & negatives)
What is the types of detection?
Packet filter - Looks at packets like a bunch of bytes.
Application filter - Knows that there is HTTP, FTF…
Stateful filter - Track connections and their states.
Deep packet inspection -
Analyses entire packet payload instead of just header information, Computationally much more expensive, Used for lawful interception & censorship (The great firewall)
Describe the NIDS placements
In-Band NIDS - Between network and node. Possible to silently drop packets. More error prone. Trickier to deploy, may increase network latency
Out-of-Band NIDS - Outside and gets copies. Can be too late when discovered.
What are the two models of detection?
Anomalies & Heuristics (pattern matching)
Describe heuristics (pattern matching)
Operates by using a pre-programmed list of known threats and their indicators of compromise.
Types:
Misuse modelling (rule-based) - Focuses on predefined rules for known attacks or vulnerabilities.
Specification modelling (rule-based) - Concentrates on defining normal or expected behavior, identifying deviations from the norm.
Describe Anomaly Detection
Checks for something that is not right.
Anomaly detection systems (ADS) are either self-learning or learning by example.
What are some problems with pattern matching
Number of signatures always increase
Network speed increases
Encoding/obfuscation
Should avoid rescanning data and support stream-based scanning
Challanges to IDS
No or very few false positives & false negatives
Encrypted traffic
Networks can be too fast
A lot of automated attacks
Failover mode
What is meant by the Base Rate Fallacy?
1% is good but can be bad if the underlying base rate is highly asymmetric.
This must be kept in mind when evaluating IDS performance.
What is meant by ”The base rate fallacy”
It refers to the tendancy to ignore relevant statistical information in favor of case-specific information.
Must be kept in mind when evaluating IDS performance.
1% false positives and negatives rate sounds good but can be bad if highly asymmetrical.
What are false positives and false negatives?
False positives are benign packets that are falsely marked as malicious.
False negatives are the other way around.
What are the ids data sources
Truncated network data
Raw network data
Network flows
Challanges for ADS
Hard to model normality
Hard to get training data
Semantic gap between anomaly and actual attack
Not easy to configure
