MD4 Components of a detection signature

Question 1

Signature syntax

Answer 1

A signature specifies detection rules. These rules outline the types of network intrusions you want an IDS to detect.

For example, a signature can be written to detect and alert on suspicious traffic attempting to connect to a port.

Question 2

Network intrusion detection system (NIDS)

Answer 2

Rule language differs depending on different network intrusion detection systems. The term network intrusion detection system is often abbreviated as the acronym N-I-D-S and pronounced NIDS.

Generally, NIDS rules consists of three components: an action, a header, and rule options. Now, let’s examine each of these three components in more detail

Question 3

NIDS rules

Action

Answer 3

Typically, the action is the first item specified in a signature.

This determines the action to take if the rule criteria matches are met.

Actions differ across NIDS rule languages, but some common actions are: alert, pass, or reject.

Using our example, if a rule specifies to alert on suspicious network traffic that establishes an unusual connection to a port, the IDS will inspect the traffic packets and send out an alert.

Question 4

NIDS rules

Header

see Course 6 - MD4 Components of a detection signature word doc for example

Answer 4

The header defines the signature’s network traffic. These include information such as source and destination IP addresses, source and destination ports, protocols, and traffic direction.

If we want to detect an alert on suspicious traffic connecting to a port, we have to first define the source of the suspicious traffic in the header. Suspicious traffic can originate from IP addresses outside the local network. It can also use specific or unusual protocols. We can specify external IP addresses and these protocols in the header.

Here’s an example of how header information may appear in a basic rule. First, we can observe that the protocol, TCP, is the first listed item in the signature. Next, the source IP address 10.120.170.17 and the source port number is specified as being any. The arrow in the middle of the signature indicates the direction of the network traffic. So we know it’s originating from the source IP 10.120.170.17 from any port going to the following destination IP address 133.113.202.181 and destination port 80.

Question 5

NIDS rules

Rule

Answer 5

The rule options lets you customize signatures with additional parameters. There are many different options available to use. For instance, you can set options to match the content of a network packet to detect malicious payloads. Malicious payloads reside in a packet’s data and perform malicious activity like deleting or encrypting data.

Question 6

NIDS rules

Rule:

Configuring rule options

see Course 6 - MD4 Components of a detection signature word doc for example

Answer 6

Configuring rule options helps in narrowing down network traffic, so you can find exactly what you’re looking for. Typically, rule options are separated by semi-colons and enclosed in parentheses. In this example, we can examine that the rule options are enclosed in a pair of parentheses and are also separated with semi-colons.

The first rule option, msg, which stands for message, provides the alert’s text. In this case, the alert will print out the text: “This is a message.” There’s also the option sid, which stands for signature ID. This attaches a unique id to each signature. The rev option stands for revision. Each time a signature is updated or changed, the revision number changes. Here, the number 1 means it’s the first version of the signature.