Scribd Logo
Upload

Welcome to Scribd!

  • 21 views

    Intrusion Detection and Malware Analysis: Signature-Based IDS

    Uploaded by

    AkshrayKc
    Snort is an open source network intrusion detection system that uses a plugin architecture. The key components of Snort include the packet sniffer, preprocessor, detection engine, and alerts/logging. The packet sniffer interacts directly with network cards to read traffic. The preprocessor performs functions like stream reassembly and protocol decoding. The detection engine uses rulesets to compare packet content and headers to known attack signatures. If a rule matches, alerts are generated and can be logged or sent to external systems. Snort's plugin architecture provides flexibility and extensibility.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Intrusion Detection and Malware Analysis: Signature-Based IDS

    Uploaded by

    AkshrayKc
    21 views14 pages
    Snort is an open source network intrusion detection system that uses a plugin architecture. The key components of Snort include the packet sniffer, preprocessor, detection engine, and alerts/logging. The packet sniffer interacts directly with network cards to read traffic. The preprocessor performs functions like stream reassembly and protocol decoding. The detection engine uses rulesets to compare packet content and headers to known attack signatures. If a rule matches, alerts are generated and can be logged or sent to external systems. Snort's plugin architecture provides flexibility and extensibility.

    Original Description:

    High-scoring Formulas High-scoring Formulas High-scoring Formulas network ccna cisco routing

    Original Title

    Signature Ids

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Snort is an open source network intrusion detection system that uses a plugin architecture. The key components of Snort include the packet sniffer, preprocessor, detection engine, and alerts/logging. The packet sniffer interacts directly with network cards to read traffic. The preprocessor performs functions like stream reassembly and protocol decoding. The detection engine uses rulesets to compare packet content and headers to known attack signatures. If a rule matches, alerts are generated and can be logged or sent to external systems. Snort's plugin architecture provides flexibility and extensibility.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    21 views14 pages

    Intrusion Detection and Malware Analysis: Signature-Based IDS

    Uploaded by

    AkshrayKc
    Snort is an open source network intrusion detection system that uses a plugin architecture. The key components of Snort include the packet sniffer, preprocessor, detection engine, and alerts/logging. The packet sniffer interacts directly with network cards to read traffic. The preprocessor performs functions like stream reassembly and protocol decoding. The detection engine uses rulesets to compare packet content and headers to known attack signatures. If a rule matches, alerts are generated and can be logged or sent to external systems. Snort's plugin architecture provides flexibility and extensibility.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    You are on page 1of 14

    Intrusion Detection and Malware Analysis

    Signature-based IDS

    Pavel Laskov
    Wilhelm Schickard Institute for Computer Science
    Misuse detection systems

    Expert systems (NIDES, Emerald): rule-based decisions,


    rather slow, binary decisions only.
    Signature matching (Snort, Bro, Cisco Secure IDS, ISS
    RealSecure): pattern matching, policy scripting.
    State transitions (STAT suite): description of attacks by
    assertions over a state transition diagram.
    Data mining: automatic extraction of attack description rules
    from labeled examples.
    Machine learning: automatic extraction of black-box
    classifiers from labeled examples.
    Snort highlights

    Initial open source release (December 1998):


    plain sniffer, no rules
    1.0 release (June 1999)
    basic rules language, stateless packet processing
    1.5 release (December 1999)
    packet pipeline architecture used up-to-date
    1.8 release developed by Sourcefire (mid-2001):
    IP fragmentation and TCP reassembly
    Current release (2.8):
    highly stateful, 3000+ rules, protocol anomaly detection
    Snort design criteria

    A lightweight intrusion detection tool


    cross-platform portability
    small footprint
    easy installation and configuration
    A simple language for rules
    High efficiency and low memory and CPU consumption
    packet-level detection (with no support for TCP stream
    reassembly in early versions)
    packet filtering using BPF and rule hierarchy
    An open source alternative to expensive commercial IDS
    2. Then it sends them through a chute to determine if they are coins and how they should
    roll (the preprocessor).

    Snort architecture
    3. Next, it sorts the coins according to the coin type.This is for storage of quarters, nickels,
    dimes, and pennies (on the IDS this is the detection engine).
    4. Finally, it is the administrators task to decide what to do with the coinsusually youll roll
    them and store them (logging and database storage).

    Figure 4.1 Snort Architecture

    Sniffer Preprocessor Detection Alerts/


    Network
    Engine Logging
    Backbone Log Files/
    Packets Database
    Rulesets

    The preprocessor, the detection engine, and the alert components of Snort are all plug-ins. Plug-
    ins are programs that are written to conform to Snorts plug-in API.These programs used to be part
    Packet sniffer interacts directly with a network card using
    of the core Snort code, but they were separated to make modifications to the core source code more
    reliable and easier to accomplish.
    libpcap.
    Packet Sniffer detection and alert components are
    Preprocessing,
    A packet sniffer is a device (either hardware or software) used to tap into networks. It works in a sim-
    implemented as plugins.
    ilar fashion to a telephone wiretap, but its used for data networks instead of voice networks. A net-
    work sniffer allows an application or a hardware device to eavesdrop on data network traffic. In the
    Various front-ends are available for logging (DB, Prelude
    case of the Internet, this usually consists of IP traffic, but in local LANs and legacy networks, it can
    be other protocol suites, such as IPX and AppleTalk traffic.
    meta-IDS, GUI).
    Because IP traffic consists of many different higher-level protocols (including TCP, UDP, ICMP,
    routing protocols, and IPSec), many sniffers analyze the various network protocols to interpret the
    packets into something human-readable.
    Packet sniffers have various uses:
    Snort sniffer

    Operates in promiscuous mode: passes all traffic to OS.


    Performs basic packet filtering using BPF.
    Decodes packet headers using pointer casts.
    typedef struct _EtherHdr {
    u_int8_t ether_dst[6];
    u_int8_t ether_src[6];
    u_int16_t ether_type;
    } EtherHdr;

    /* lay the ethernet structure over the packet data */


    p->eh = (EtherHdr *) pkt;
    Snort preprocessors

    441_HTC_OS_04.qxd 4/12/07 9:45 AM Page 191

    Introducing Snort

    Figure 4.3 Snorts Preprocessor


    Plugin architecture enables
    dynamic plugin configuration. Preprocessor Detection Engine

    Preprocessor functions:
    Packets
    Stream reassembly (stream4)
    Packet defragmentation (frag2)
    HHTP Encoding Plug-in
    Protocol decoding/normalization
    (HTTP, RPC, telnet)
    Port Scanning Plug-in
    Alternative (non-rule) detection
    modes (portscan, arpspoof)
    Earlier in this chapter, we described Snort as a signature-based IDS.The signature-ba
    function is accomplished by using various rulesets.The rulesets are grouped by category (
    horses, buffer overflows, access to various applications) and are updated regularly.
    The rules themselves consist of two parts:
    The rule header The rule header is basically the action to take (log or alert)
    network packet (TCP, UDP, ICMP, and so forth), source and destination IP add
    ports
    The rule option The option is the content in the packet that should make th
    match the rule.
    The detection engine and its rules are the largest portion (and steepest learning curv
    information to learn and understand with Snort. Snort has a particular syntax that it uses
    rules. Rule syntax can involve the type of protocol, the content, the length, the header, an
    ious elements, including garbage characters for defining butter overflow rules.
    Snort detection engine
    441_HTC_OS_04.qxd 4/12/07 9:45 AM Page 192

    192 Chapter 4 Introducing Snort

    Figure 4.4 Snorts Detection Engine


    Rules are parsed into internal data
    structure. Detection Engine Logging/Alert

    Rule matching is prioritized Packets

    according to matching complexity:


    Rule
    IP header rules
    TCP header rules
    Do the If Yes, Send to
    Application protocol header rules Packets Logging/Alerting
    Match?
    Content rules
    No
    Multiple matches are possible: the
    highest priority alert is reported. Discard

    Alerting/Logging Component
    After the Snort data goes through the detection engine, it needs to go out somewh
    matches a rule in the detection engine, an alert is triggered. Alerts can be sent to a
    network connection, through UNIX sockets or Windows Popup (SMB), or SNMP
    can also be stored in an SQL database such as MySQL and Postgres.
    You can also use additional tools with Snort, including various plug-ins for Pe
    servers to display the logs through a Web interface. Logs are stored in either text fi
    /var/log/snort) or in a database such as MySQL and Postgres.
    Like the detection engine and the preprocessor, the alert component uses plug
    Snort rules

    General format: header (options)


    Header:
    fixed format
    present in every rule
    Options:
    variable format
    not always necessary
    Example:
    alert tcp $BAD any -> $GOOD any
    (flags: SF; msg SYN-FIN scan;)
    Snort rules: header

    General format: action proto srcaddr srcport dir dst


    addr dstport
    Example: alert tcp $BAD any -> $GOOD any
    Actions
    alert, pass, log
    Protocols
    tcp, udp, icmp, ip
    Directions
    -> (unidirectional), <> (bidirectional)
    Variables, wildcards and expressions can be used, e.g.
    !$HOME, any, etc.
    Snort rules: options

    General format: ( keyword: value; )


    Example: (flags: SF; msg SYN-FIN scan;)
    Basic options:
    content: pattern matcher
    pcre: Perl-compatible regular expression
    msg: alert message
    flow: test for TCP connection state, traffic direction
    Content options can be combined using the conjunction.
    Snort rules: advanced options

    Informational options
    sid (Snort ID), priority, ref (reference, usually to CVEs)
    Advanced payload options
    byte_jump, byte_test, distance, within, depth, offset, nocase,
    rawbytes, uricontent
    Protocol analysis options
    Keywords for IP, TCP, ICMP protocols
    Stateful rules
    flowbits, threshold, flow
    Regular expressions
    use with care: expensive!
    Snort rule examples

    alert tcp any any -> any any \


    (flow: established, to_server; \
    content: "foo"; msg: "detected foo";)

    alert tcp $EXTERNAL_NET any -> $SMTP_SERVERS 25 \


    (msg:"SMTP exchange mime DOS"; flow:to_server,established; \
    content:"charset = |22 22|"; nocase; reference:bugtraq,1869; \
    reference:cve,2000-1006; reference:nessus,10558; \
    reference:url,www.microsoft.com/technet/security/bulletin/MS00-082.m
    classtype:attempted-dos; sid:658; rev:11;)

    alert tcp $EXTERNAL_NET 80 -> $HOME_NET any \


    (msg:"EXPLOIT Netscape 4.7 client overflow"; flow:to_client,establish
    content:"3|C9 B1 10|?|E9 06|Q<|FA|G3|C0|P|F7 D0|P"; \
    reference:arachnids,215; reference:bugtraq,822; \
    reference:cve,1999-1189; reference:cve,2000-1187; \
    classtype:attempted-user; sid:283; rev:10;)
    Snort summary

    A de-facto standard IDS in the practical security community


    More than 3,000,000 downloads
    About 200,000 users
    A light-weight, easily configurable IDS
    Good performance and reliability
    Moderate expressivity of rule language
    Numerous appliances available
    Database, logging and alert interfaces
    GUI tools
    Intrusion prevention and firewall interfaces
    Shared object rules: more complex functionality

    You might also like