Re: IDS detection approaches

[Liran Cohen <theog () rct co il>]

I think blocking packets based on scoring of the source is a very bad 
way to go, just like spam it will result in a lot of false positives, 
and actually lead to a "selective" internet which I am sure many dont 
want the thing is by scoring you cannot just decide a subnet is likely 
to have attacks originating from it thus block that subnet (like people 
do with e-mails) I happened to see a lot of e-mails servers which were 
blocked due to CBLs and such and were in fact clean servers but removing 
such an entry from the CBLs is a very long tiring process resulting in 
servers such as hotmail which many dont use because it blocks many 
subnets. I would hate to see the same happen with IDS i.e. trying to 
surf the internet and getting a "your page has been blocked due to IP 
black listing from your subnet" because someone decided to perform an 
attack from my subnet.

My 2 cents.... ;)

'Merigoth' wrote:
> FF, I believe IDS placement should depend upon it's purpose. The
> purpose of the IDS should determine where the IDS is placed. For
> example, an IDS whose purpose is to identify all possible inbound
> threats for firewall tweaking (or returning traffic back to the
> community ;]) should be placed outside the firewall. A production
> protection IDS would probably be better placed inside the firewall.
> Defense-in-depth and architecture design are two key points to
> remember.
>
> As far as answering the initial question, one new trend is
> "vector-based" modeling. Take a look at http://www.trustedsource.org/,
> and the trustedsource query. Plug in a few IP addresses and see.
> (NOTE: I do not work for secure computing.) The simplistic idea is a
> network space, 192.168.1.x (for example), is given a "credit card"
> score (or trust-worthiness score). This "trust-worthiness" score is a
> determination of the network space to be secure and remain secure at a
> given point in time. If the IP address or network space is flagged as
> malicious, a firewall admin may wish to block all traffic to/from that
> IP space. Remember that saying about blocking email based upon country
> codes/location/email language due to the likelihood of spam. This
> takes that idea and makes it a little more useful, in my opinion. This
> is possible because it is an aggregation of flow data, signature based
> and heuristic/anomaly detection IDS capabilities. 
>
> Partially referring back to the initial paragraph and what others have
> mentioned, a company needs a blended IDS system. Signature-based
> systems require dedicated analysts to maintain, and can quickly absorb
> storage space on large links. Flow data, usually coming from routers,
> can provide important information. However, it usually requires an
> outside trigger (like a trustworthiness score or an IDS event) to
> research. One of the key benefits of flow data is the amount of
> traffic passed for an event. An IDS system may not capture the full
> stream or storage may be an issue. Flow data can record the totally
> bytes passed, which can be in the 10s of megs of data, in the space of
> a few hundred bytes. So the conversation turns back into
> defense-in-depth and architecture design.
>
> I think application layer / "deep packet analysis" is also starting to
> take off, as well.
>
> Hopefully, this helps snort user.
>
>
> -----Original Message-----
> From: listbounce () securityfocus com
> [mailto:listbounce () securityfocus com] On Behalf Of
> frankfrydrych () gmail com
> Sent: Thursday, October 04, 2007 4:30 PM
> To: focus-ids () securityfocus com
> Subject: Re: IDS detection approaches
>
> Hola,
>
>
> I would completely go with a signature based IDS. Anomaly based IDS
> will not give you the greatest results. 
>
>
> For signature base I highly recommend SNORT. It is probably one of the
> best IDS out there. Now I'm not just saying this as a "ooh open source
> is the best".  I truely believe this. I actually use to be a huge
> Cisco buff and just dealt with Cisco IDS. However, at my current job I
> am a security analyst and have to analyze events from Cisco, IIS,
> Juniper, etc, and SNORT beats them all. Mainly for the fact that you
> are able to see the packet payload and are able to make the decision
> if something is malicious based on the actual payload and not just the
> signature that is triggered (like some IDS). Also, when a new threat
> emerges usually SNORT users will create a signature to combat the
> threat. The other vendors create the signatures for you and it usually
> ends up to be like 3 months after the threat was actually a realistic
> threat. And on top of it the vendor signatures usually give out huge
> amount of false positves. Then again, an IDS is only as good as who
> tunes it. If you take A
>  NY IDS and turn it on in a production network you will have so many
> false positives I garuntee you will miss actual threats. Every IDS
> (including SNORT) has to be tuned for the production network it is on.
>
>
> Finally, make sure to place the IDS behind the firewall. If you place
> it in front of the firewall you will receive so much traffic that it
> is just not valuable data. You have a firewall, so let the firewall do
> its job and block the already known bad activity, and catch what gets
> through the firewall with a IDS.
>
>
> -FF
>
> ----------------------------------------------------------------------
> --
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to
> http://www.coresecurity.com/index.php5?module=Form&action=impact&campa
> ign=intro_sfw 
> to learn more.
> ----------------------------------------------------------------------
> --
>
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it 
> with real-world attacks from CORE IMPACT.
> Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
> to learn more.
> ------------------------------------------------------------------------
>
>
>   

--
Liran Cohen
http://www.rct.co.il
http://www.dir.rct.co.il


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------