• Intercepts inbound/outbound network
• Filters malicious packets.
• Realtime traffic monitoring.

Features

• Stateful Packet Inspection

Intrusion Prevention System

• Automatic action without admin
• IDS + Action

Methods

• Signature Based Detection
• Anomaly Detection
• Protocol Anomaly Detection

Example

• Suricata

IDS

The Intrusion Detection System (IDS) is a crucial component of network security designed to monitor activity for signs of malicious or policy-violating behavior.

I. Definition and Core Function

An IDS is a security software or hardware device that inspects all inbound and outbound network traffic for suspicious patterns that may indicate a network or system security breach.

• Primary Goal (Detection): The IDS checks traffic for signatures that match known intrusion patterns and raises an alarm when a match is found. It is used to monitor, detect, and protect networks or systems from malicious activities.
• Functionality: The IDS gathers and analyzes information from within a computer or network to identify possible violations of the security policy, including unauthorized access or misuse.
• Packet Handling: An IDS is sometimes referred to as a "packet sniffer" because it intercepts and analyzes packets traveling via various communication media and protocols, usually TCP/IP, evaluating traffic for suspected intrusions.
• Alerts: When an intrusion is detected, the IDS raises an alarm to notify the administrator.

II. Types and Placement of IDS

IDS can be categorized based on their functionality and where they reside in the network architecture:

A. Classification by Functionality

1. Passive IDS: Generally only detects intrusions.
2. Active IDS (Intrusion Prevention System - IPS): An Intrusion Prevention System (IPS) is considered an active IDS because it is capable of both detecting and preventing intrusions.

B. Classification by Location/Scope

1. Network-Based IDS (NIDS):
   • Mechanism: NIDS monitors traffic to and from all devices on the network. They are typically placed at a strategic point within the network.
   • Operation: NIDS checks every packet entering the network for the presence of anomalies and incorrect data, capturing and inspecting all traffic. They generally consist of a black box placed on the network in promiscuous mode, listening for patterns indicative of an intrusion.
   • Detection Focus: NIDS detects malicious activity such as Denial-of-Service (DoS) attacks, port scans, or attempts to break into computers by monitoring network traffic.
2. Host-Based IDS (HIDS):
   • Mechanism: HIDS analyzes each system's behavior. It is installed on a single host (ranging from a desktop PC to a server).
   • Detection Focus: HIDS is effective in detecting unauthorized insider activity and unauthorized file modification, focusing on the changing aspects of local systems. These systems usually involve auditing for events that occur on a specific host. HIDS is less common due to the overhead incurred by monitoring every system event.

C. Network Placement

The most common location for deployment is near the firewall.

• An IDS is placed outside/inside the firewall depending on whether the goal is to monitor suspicious traffic originating from outside or inside the network.
• The best practice is to use a layered defense by deploying one IDS in front of the firewall and another one behind the firewall in the network.

III. Intrusion Detection Methods

An IDS uses three primary methods to detect intrusions:

1. Signature Based Detection (Misuse Detection):
   • Mechanism: This method compares incoming or outgoing network packets with binary signatures of known attacks using simple pattern-matching techniques. The system must know about the attack to detect it.
   • Limitation: Signature recognition can only detect known attacks. Changing a single bit in some attack strings can invalidate a signature, requiring entirely new signatures for detection.
2. Anomaly Detection (Not-Use Detection):
   • Mechanism: This method establishes a model of normal network behavior and detects an intrusion when an event occurs outside the tolerance threshold of normal traffic. Any deviation from regular use is flagged as an attack.
   • Advantage: Anomaly detection systems can identify unknown attacks.
3. Protocol Anomaly Detection:
   • Mechanism: Analyzes network traffic to detect deviations from established protocol standards or expected behavioral patterns, such as unusual packet structures or unexpected sequence orders.

IV. Evasion Techniques and Countermeasures

IDS and firewalls are security mechanisms intended to prevent access, but they have limitations that attackers exploit.

A. Common Evasion Techniques Targeting IDS

Attackers attempt to fool the IDS into interpreting malicious traffic as legitimate:

• Encryption: If an attacker succeeds in establishing an encrypted session (using SSH, SSL, or VPN), the IDS will not analyze the packets going through these encrypted communications.
• Insertion Attack: Confusing the IDS by forcing it to read invalid packets that the end system rejects. This attack exploits the condition where the NIDS is less strict than the internal network, causing the IDS to reconstruct a different string than the end system.
• Evasion Attack: Occurs when the IDS discards packets while the host accepts them. The attacker sends portions of the request in packets that the IDS mistakenly rejects, allowing the malicious data to pass unnoticed.
• Fragmentation Attack: Splitting the probe packet into smaller fragments so that the IDS stops reassembling or skips the fragmented packets, allowing the attack to circumvent signature-based detection.
• Session Splicing: Splitting the attack traffic into an excessive number of small packets such that no single packet matches any patterns in the IDS signature, thereby bypassing detection.
• obfuscation: Encoding the attack packet payload so that the destination host can decode it but the IDS cannot, often using Unicode characters or polymorphic code to circumvent signature matching.
• DoS Attack: Overloading the IDS resources (CPU cycles, memory, disk space, or network bandwidth) with noise or fake traffic, preventing the IDS from analyzing true attack traffic.
• ACK Tunneling: Leveraging the fact that firewalls and IDS often filter ACK packets less rigorously than SYN packets by injecting malicious payloads into ACK packets.

B. IDS Evasion Countermeasures

To defend against IDS evasion, security professionals should implement:

• Traffic Normalization: Use a traffic normalizer to remove potential ambiguity from the packet stream before it reaches the IDS. Ensure the IDS normalizes fragmented packets and allows them to be reassembled in the proper order.
• Hybrid Detection: Employ a hybrid signature-based exploit protection technique that uses advanced statistical and behavioral analysis techniques to prevent evasion using zero-day exploits.
• Logging and Auditing: Regularly audit network traffic logs for unusual activities.
• Rule Configuration: Configure IDS rules to detect tunneling and obfuscation techniques. Ensure Snort rules are perfectly configured to avoid DoS attacks resulting from false positives.
• Encryption Defense: Since encryption evades NIDS, ensure systems are configured to detect suspicious network activity, including LLMNR/NBT-NS poisoning attempts.

V. IDS Tools

Specific tools are available for intrusion detection:

• Snort: An open-source Network IDS capable of performing real-time traffic analysis and packet logging on IP networks. It performs protocol analysis, content searching/matching, and detects various attacks like buffer overflows, stealth port scans, and OS fingerprinting attempts. Snort can be configured in sniffer mode, packet logger mode, or Network Intrusion Detection System mode. It allows users to write their own rules to differentiate between normal and malicious activities.
• Suricata: A robust network threat detection engine capable of real-time IDS, inline IPS, network security monitoring (NSM), and offline pcap processing.
• YARA: A malware research tool used by security analysts to detect and classify malware through a rule-based approach, allowing for the creation of rules for examining malicious binaries across an organization to detect intrusions.
• Samhain HIDS and OSSEC are examples of Host-based IDS tools.
• Kismet: A network detector, packet sniffer, and IDS for 802.11 wireless LANs.
• Vindicate: A tool used by security professionals to detect name service spoofing, helping to secure IDS, VPN, and firewall configuration.

IPS

The Intrusion Prevention System (IPS) is a critical security mechanism that serves as an active defense against network and system security breaches. It functions as an evolution of the Intrusion Detection System (IDS), adding the capability to actively block malicious traffic.

I. Definition and Core Functionality

1. Active IDS: An IPS is explicitly defined as an active IDS because it is capable of not only detecting intrusions but also preventing them.
2. Placement (Inline): Unlike a passive IDS, an IPS is placed inline in the network, situated between the source and the destination. This positioning allows the IPS to actively analyze the network traffic and make automated decisions regarding traffic entering the network.
3. Action: The main functions of an IPS are to identify malicious activity, log information about it, report it, and most importantly, attempt to block or stop it.

II. Actions and Benefits of an IPS

An IPS performs several active countermeasures based on configured rules and policies:

• Blocking and Filtering: It can block and drop illegal packets and filter malicious traffic within the network.
• Alert Generation: It generates alerts if any abnormal traffic is detected.
• Threat Elimination: It detects and eliminates threats quickly because it is placed inline in the operational network.
• Traffic Control: It can prevent the occurrence of direct attacks in the network by controlling the amount of network traffic.
• Security Policy Enforcement: IPS can be employed to detect critical issues in corporate security policies, such as insider threats and malicious network guests.
• Monitoring and Logging: It continuously records real-time logs of network activities.

III. Integration and Defense Context

IPS deployment is a fundamental element of a comprehensive network defense strategy:

• Layered Defense: IPSes are continuous monitoring systems that often sit behind firewalls as an additional layer of protection. This practice is part of the Defense-in-Depth strategy, where multiple protection layers are used throughout an information system.
• Vulnerability Monitoring: IDS/IPS solutions are used in the monitoring phase of vulnerability management to thwart ever-evolving threats.
• Threat Intelligence Integration: IPS, along with IDS, firewalls, and endpoint security systems, can use technical threat intelligence—collected from active campaigns or third-party data feeds—to enhance detection mechanisms. This intelligence is directly fed into the security devices to block and identify inbound and outbound malicious traffic.
• DoS/DDoS Countermeasure: IPS is a key tool in defending against scanning and DoS/DDoS attacks. For instance, the Cisco IPS regularly updates its database with known threats, such as botnets, to filter DoS traffic before it damages critical assets. A defense-in-depth approach can use IPSes to divert suspicious DoS traffic to honeypots.
• Evasion Defense: IPS is employed to identify port scan attempts and blacklist IP addresses. IPSes should be configured to detect tunneling and obfuscation techniques and are sometimes paired with Application-Level Firewalls (or Next-Generation Firewalls) which incorporate integrated IPS features.

IV. Examples of Intrusion Prevention Tools

Specific commercial solutions available for Intrusion Prevention include:

• Trellix Intrusion Prevention System: Aggregates flow data and performs network-level threat behavior analysis to correlate unusual patterns, helping detect stealthy botnets, worms, and reconnaissance attacks.

• Check Point Quantum IPS.

• Cisco Secure IPS (NGIPS).

• Palo Alto Advanced Threat Prevention.

• Atomic OSSEC and McAfee Host Intrusion Prevention for Desktops are also listed.

• Snort