RE: Specification-based Anomaly Detection

["Kohlenberg, Toby" <toby.kohlenberg () intel com>]

All opinions are my own and in no way reflect the views of my employer. 

> -----Original Message-----
> From: Stefano Zanero [mailto:zanero () elet polimi it] 
> Sent: Monday, January 10, 2005 12:50 AM
> To: Ofer Shezaf
> Cc: focus-ids () lists securityfocus com
> Subject: Re: Specification-based Anomaly Detection
>
> Ofer, list,
>
> > I agree that anomaly detection is a new-comer to IDS, and in 
> many cases
> > not a mature technology. But I think that due to the inherent
> > shortcomings of signatures, it has to be considered seriously.
>
> That's one of the lines of the speech I delivered at Black Hat 
> - so I'd 
> say I agree warmly with you :)

Stefano, could you expand on which part you agree with? I'm really
confused to think that you would agree that anomaly detection would
be new to IDS.

> > As one of you mentioned, the main disadvantage of signatures 
> is zero day
> > attacks
> Or highly polimorph attacks, yes.
Or custom-written attacks, which appear to be on the rise and 
can be developed specifically to avoid anomaly-based methods as
well (example being the agobot DDoS function that sends a single
GET request and then waits an extended period of time so that it 
appears to be the slashdot effect instead of a DDoS).

> > 2. On the network layer, network profiling analyzes the 
> normal behavior
> > of users (i.e traffic), while in the application layer we 
> also profile
> > the normal behavior of the application.
> Sorry, I don't see how this makes a difference. By definition, 
> a couple 
> (host, port) defines a listening application, so we can profile 
> application-based traffic profiles if we want to.

Really? What about apps that all tunnel over a single port? Are you
profiling IE or gmail or IM over HTTP or a SOAP app or an SSL VPN?
Are you getting the application that IANA says runs on that port or
are you getting SAP using telnet on some random port or Cisco using
HTTP on yet another random port?

> > 1. Application Layer Signatures - these signatures detect 
> content that
> > may indicate an application layer attack. These signatures 
> are much more
> > prone to false positives and may be more computationally complex to
> > detect. Simple examples are the word "select" (used in SQL injection)
> > and Win 32 assembly code (buffer overflows). Application 
> signatures are
> > effective to determine an actionable item once an anomaly 
> was detected.
>
> This is basic misuse detection, it does not mean you can deliver an 
> actionable anomaly detection result.

No, but it does give you a much better chance of finding "actionable"
(or ignorable) when you don't have someone like Tom to look at the
packets. That's the reason why people loved early ISS so much, it
didn't matter whether it was right or wrong, just that when it
said something was wrong that it also told you what you should do
about it.

toby

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------