Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

CS 6035 CP > P2L4 Intrusion Detection > Flashcards

P2L4 Intrusion Detection Flashcards

1
Q

Defense in Depth

A

Need multiple layers of defense mechanisms. Prevent, Detect, Survive

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Firewall

A

Prevention Mechanism

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Intrusion Examples

A
  • Remote root compromise
  • Web Server Defacement
  • Packet Sniffer
  • Copying database containing CC numbers
    etc
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

Intrusions Steps

A
  1. Target Acquisition & Info gathering
  2. Initial Access
  3. Privilege Escalation
  4. Info Gathering or system exploit
  5. Maintain access (backdoors etc)
  6. Cover tracks (remove evidence of attack or install root kit
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Backdoor inserts backdoors into other programs during compilation

A

Compiler Backdoor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Backdoor can only be used by person who created it , even if discovered by others

A

Asymmetric Backdoor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Backdoor hard to detect because it modifies machine code

A

Object Code Backdoor

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Primary Assumptions design of IDS

A

System activities are observable

Normal and intrusive activities have distinct evidence

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Components of IDS

A 
Algorithmic:
- Features - capture intrusion evidence
- Models - piece evidence together
System Architecture:
- Several components: data processor, knowledge base, decision engine, alarm generation, and responses
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

IDS modeling and analysis approaches

A
  • Misuse detection (aka signature-based)

- Anomaly detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

IDS deployment approaches

A
  • Host-based

- Network-based

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

IDS development and maintenance

A
  • Hand-coding of “expert knowledge”

- Learning based on data

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Anomaly Detection

A
  • Collect data relating to behavior of legitimate users over a period of time. Build a model on this.
  • Analyze current observed data to determine whether is legitimate (fits model)
  • Statistical Approach
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Misuse / Signature Detection

A
  • Use set of known malicious data patterns relating to legitimate users over time
  • Current behavior is analyzed to determine if it is legitimate.
    *Can only detect known attacks/intrusions
    Example: Virus scanner
    -Knowledge Based Approach
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Machine Learning Approaches

A
  • Detects attacks similar to past attacks.
  • Flexible and adaptable.
  • Training data must normal, otherwise false alarms.
    Types:
    Bayesian Networks - Conditional probabilities (ex how likely this happens when this other thing happens)
    Markov Models - Model of states (ex: real website names vs random botnet names)
    Neural Network - Simulates how human brain operates.
    Clustering - Group data into similar clusters to identify common characteristics
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Network Based IDS

A

Passively monitors traffic at selected points
May examine network, transport, and/or app level protocol activity
Comprised of sensors, servers, and mgmt console
Analysis of traffic patterns done at sensor, mgmt server or combo of two

17
Q

Misuse Signature Intruder Detection

A

Run through a signature mapping to identify and flag intrusion attempts.

18
Q

Rule Based Detection

A

SNORT.

Set of specific rules that identify known penetrations or suspicious behavior.

19
Q

Host based IDS

A

Sits on the hosts, monitors activity on the host.

ptrace - traces operating system events

20
Q

Inline Sensors

A

Type of NIDS
Performs both intrusion detection and prevention.
Must be placed a network point where traffic passes through it
Can be standalone, or combination of firewall and NIDS

21
Q

Passive Sensor

A

Monitors copy of traffic

More efficient

22
Q

Firewall vs Network IDS

A

Firewall
- Active Filtering
- Fail-close (when firewall fails external network is closed to internal network, internal network is safe)
Network IDS
- Passive Monitoring
- Requires CPU intensive analysis
- Fail-open (fails to protect network and network is open to intrusion)

23
Q

Common place for NDIS Sensor and why?

A

Just inside the external firewall

  • Sees attack from outside
  • Highlights issues with external firewall performance
  • Sees attack on web server or ftp in DMZ
  • Can also see outgoing traffic and analyze for detection
24
Q

Alternative place for NDIS sensor and why?

A

Outside external firewall

  • Detects all attacks originated from internet
  • Does not rely on firewall, so can see attacks that firewall misses or drops
25
Q

Yet another place for NDIS sensor and why?

A

Inside Internal firewall

  • Monitors all internal traffic increasing possibility of detecting attack
  • Detected unauthorized activity by authorized users
26
Q

One more option for NDIS sensor and why

A

In front of particular system or subnet

  • Detects targeted attacks against sensitive systems
  • Allows focusing limited resources on assets of greatest value
27
Q

SNORT

A
  • Open source
  • Highly configurable
  • Lightweight
  • Can be deployed on most nodes
  • Performs real time packet analysis and detects attacks/probes based on rules
28
Q

SNORT 4 components

A

Decoder - Decodes network/transport/app layer packets
Detection Engine - Compares decoded packet against a rule
Log - Log if packet matches rule, logs packet in human readable format
Alert - send alert

29
Q

Snort Configuration

A

In passive mode:
Monitors traffic
Not in transmission path
Not an inline sensor

30
Q

Honeypots

A

Decoy systems designed to lure attackers away from critical systems.
Observer what attackers are trying to do
Develop strategy to respond to attack

31
Q

Types of Honeypots

A

High or Low interaction

32
Q

Low interaction honeypot

A

Does not execute full version of all services
Less realistic
Sufficient for use as a component in a distributed IDS to warn of attack

33
Q

High interaction honeypot

A
  • Replicates real system and full operating system
  • More realistic target, attacker can’t tell
  • Challenging to emulate a real system
34
Q

Honey Pot Deployment options

A
  • Outside external firewall (less risk for internal network, but cannot trap internal attackers)
  • In DMZ inside external firewall ( DMZ is not fully accessible, can’t attract interesting attacks )
  • Inside internal network (catch internal attacks or misconfigured firewall, but compromised honeypot can attack internal systems also must open up internal firewall huge risk)
35
Q

Ways to evaluate IDS

A

True Positive Rate (correct alert)
False Negative Rate (intrusions we missed)
False Positive Rate (false alert but no intrusion)
True Negative Rate (correctly classify normal actives)
Bayesian Detection Rate (Given an IDS alert, how likely is it not an intrusion?)

CS 6035 CP (2 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions