Scribd Logo
Upload

Welcome to Scribd!

  • Intrusion Detection System

    Uploaded by

    GowriShankar Muthukrishnan
    24 views10 pages
    Snort is a free and open source intrusion detection system that monitors network traffic, scans for protocol anomalies and packet signatures that could indicate attacks. It is best placed at natural choke points like areas of single traffic flow due to network topology, or artificial choke points between intranet trusted and untrusted zones. Snort works using rules to detect signatures like the example given, but can generate false positives. Its monitoring console BASE shows statistics on alerts, their categories, most frequent source/destination ports, and more. It was used in an example to detect propagation of the Bagle worm variant across workstations by monitoring for a specific gif file in traffic.

    Original Description:

    IDS

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPT, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    Snort is a free and open source intrusion detection system that monitors network traffic, scans for protocol anomalies and packet signatures that could indicate attacks. It is best placed at natural choke points like areas of single traffic flow due to network topology, or artificial choke points between intranet trusted and untrusted zones. Snort works using rules to detect signatures like the example given, but can generate false positives. Its monitoring console BASE shows statistics on alerts, their categories, most frequent source/destination ports, and more. It was used in an example to detect propagation of the Bagle worm variant across workstations by monitoring for a specific gif file in traffic.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as ppt, pdf, or txt
    24 views10 pages

    Intrusion Detection System

    Uploaded by

    GowriShankar Muthukrishnan
    Snort is a free and open source intrusion detection system that monitors network traffic, scans for protocol anomalies and packet signatures that could indicate attacks. It is best placed at natural choke points like areas of single traffic flow due to network topology, or artificial choke points between intranet trusted and untrusted zones. Snort works using rules to detect signatures like the example given, but can generate false positives. Its monitoring console BASE shows statistics on alerts, their categories, most frequent source/destination ports, and more. It was used in an example to detect propagation of the Bagle worm variant across workstations by monitoring for a specific gif file in traffic.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPT, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as ppt, pdf, or txt
    of 10

    Intrusion Detection System

    Snort

    What is Snort?

    Free and Open Source Intrusion Detection System


    Monitor network traffic Scan for protocol anomalies Scan for packet payload signatures that represent potential attacks, worms, and unusual activities

    Monitoring consoles available Can be configured as an IPS

    Where should it be placed?

    Snort Tap Placement

    Natural Choke Points


    Areas

    where the network topology creates a single traffic path due to logical topology of the network

    Artificial Choke Points


    Exist

    Intranet Trust/Un-trust Zone Boundaries


    Similar

    to Natural Choke Points but are intranetwork

    How does it work?

    Snort Rules
    Primarily a signature based detection engine Example:

    alert

    tcp $TELNET_SERVERS 23 -> $EXTERNAL_NET any (msg:"TELNET root login"; flow:from_server,established; content:"login|3A| root"; classtype:suspicious-login; sid:719; rev:7;)

    While indicative of attacks, leaks, and protocol violations, false positives are generated

    How to monitor?

    BASE (Basic Analysis and Security Engine)


    Number of unique alerts Alerts ordered by category Todays alert Most frequent src/dest ports

    BASE Main Screen

    BASE Policy Violations

    Worm Propagation Analysis Example

    Multiple Layers of Antivirus checkers in place: workstations, servers, email-stores, and email gateways Most active updating checkers gets new signatures every 15 minutes On September 2005, 3 bagle variants were released quickly AV companies alerted us, but workstations were affected Which of the 5000 workstations were affected?

    Worm Propagation Analysis Example

    alert tcp any any -> any any (msg:"Potential Bagle Propagation"; content:"osa6.gif"; classtype:policyviolation; sid:1000003; rev:3;)

    Conclusion
    Snort provides another tool in the toolkit and can help provide information about exactly whos talking to who on the network Security is a process, not a product

    You might also like