Network Forensics Flashcards

Question

``` What is the common log formats? Select correct ones: a. CVE b. NCSA c. ELF d. NCI ```

Answer 1

b. NCSA | c. ELF

Answer 2

There are four types of IDS: - **Network Intrusion Detection System (NIDS)** monitor the network layer by evaluating network traffic -> sniffers (looking for anomalies). - **Host-based Intrusion Detection Systems (HIDS)** operate directly on the computer hosts by the monitoring system. - **Protocol-based Intrusion Detection Systems (PIDS)** monitor a specific protocol. - **Application Protocol-based Intrusion Detection System (APIDS)** focus on some applications. How we can do this? -> Firewalls, IDs, computer workstations, anti-virus, databases, end-user applications. Usually, they do not work jointly.

Answer 3

a. HIDS based on the specific machine, they work locally. b. NIDS detects attacks, and HIDS tells if they were successful. c. They can detect attacks that are not visible on the network level.

Answer 4

1. **Bandwidth** - Network probes must receive all network traffic, reassemble that traffic, and analyze the traffic. Network size can increase as well: the NIDS system must scale. 2. **Packet fragmentation and reassembly** -Hackers conceal their activity from NIDS by fragmenting their packets: the packet needs to be reassembled (first to last or last to first) to be analyzed. No problem if no overlapping occurs: hackers send overlapped packets. 3. TTL manipulation 4. Encryption - data can not be seen if encrypted: place sensors outside the encrypted channel.

Answer 5

§ TTL field of TCP/IP packets specifies how long a packet should be considered valid (1-255). § Each time a packet passes through a router, TTLçTTL -1 § TTL = 0, the packet is discarded. § Attacker sends packet with low TTL to create fake traffic hiding attacking packets (high TTL)

Answer 6

**Anomaly detection (Profile based)** - analyzes computer activity and network traffic looking for anomalies. Anomaly - deviation from what is defined as normal (by the system administrator) -> user group profile. Misuse detection (Signature-based) - use signature files to detect intrusive activity.

Answer 7

``` Anomaly detection (Profile based) Proc: 1. Intruders do not know if they generate alarms 2. Detect internal attacks 3. Profiles are dynamic ``` Cons: 1. High initial prep time 2. No protection during training 3. With constant updates as users’ habits change 4. Defining normal behaviour can be difficult 5. False positives, false negatives 6. Hard to understand ``` Misuse detection (Signature-based) Pros: 1. Files created on known attack 2. Given the files, protection is instantaneous 3. Easier to understand and configure ``` Cons: 1. Inability to detect new or unknown attacks 2. Inability to detect variations of known attacks 3. Signature database administration 4. Sensors must maintain state information

Answer 8

Logging packets as key routers and later mining them for attack path reconstruction Packet-marking places part or the complete address of the router into the IP packet randomly with a fixed probability or only once deterministically. There are also Hybrid traceback approaches that integrate packet marking and packet logging to achieve the advantages of both the techniques:

Answer 9

1. Logging packets - source path isolation engine (SPIE): hash of multiple fields in the packet. - autonomous management network (AMN): monitoring manager receives requests from sensors. 2. Packet-marking - probabilistic packet marking (PPM) - advanced and authenticated packet marking (AAPM): 8-bit hash of the address - algebraic packet marking (APM): algebraic techniques to calculate 15-bit marks as points on polynomials. - fast internet traceback (FIT): uses a fragment of the hash, the number of fragments and a distance field - deterministic packet marking (DPM) - deterministic edge router marking (DERM) 3. Hybrid traceback - distributed link list traceback (DLLT): router marks a packet, stores current IP address and packet ID in the marking table - hierarchical IP traceback system (HITS) - hybrid single packet IP traceback (HIT) - logging and deterministic packet marking (LDPM)

Answer 10

Commercial: b. Sandstorm NetIntercept d. Niksun NetVCR f. Trust Network Forensics Open-source: a. Wireshark g. grep, tcpdump c. shark

Answer 11

True | Collecting enough wireless traffic leads to the estimation of the WEP key (a.w.a. WEP+, ...)

Answer 12

True | Collecting enough wireless traffic leads to the estimation of the WEP key (a.w.a. WEP+, ...)

Answer 13

1. **Multi-sensors data fusion** - collect the logs from all network security products, deployed in the entire network and perform data fusion. - packet analyzers (Wireshark / tcpdump) - intrusion-detection systems(snort), - routers,firewalls,log servers,etc. - alerts generated by IDS, - statistics from protocol analyzers and attack information by observing various threshold values Dempster-Shafer's theory for information fusion determines the validity of the attack. 2**. Identification of Attack Events -** A large amount of memory and storage is usually required; network events useful for investigative requirements need to be identified and an effective mechanism is to be in place to identify attack features from the traces. 3. **Attack Reconstruction** - Important events involving intruders’ interaction with the compromised system are reconstructed and the methodology of the attackers is analyzed. 4. **Traceback and Attribution** - determining the origin of a packet. Techniques based on packet marking, packet logging or hybrid approaches. Attribution relies on analyzing the data packets transmitted, applications being run, and protocols violated. 5. **Incident Response -** traffic patterns are observed and are to be launched immediately when the alerts begin; the attacker must not be aware of the response. Detection and validating the incident by reviewing pertinent logs, network topology, etc. It determines the vulnerability exploited in the compromise of a system and enforces protection against exploitation of the same on other systems. It develops a strategy regarding containment, eradication, recovery, and investigation.