SlideServe
Télécharger Obtenir Pro
Menu
Accueil Pro
Préférences
ApparenceLight Aide et commentaires
© SlideServe · v2026

Signature Based and Anomaly Based Network Intrusion Detection

elvin avatar
elvin
10 diapositives · 402 Views · Aug 09, 2014

Signature Based and Anomaly Based Network Intrusion Detection . By Stephen Loftus and Kent Ho CS 158B . Agenda. Introduce Network Intrusion Detection (NID) Signature Anomaly Compare and Contrast: Signature based vs. Anomaly based NID Example using Ethereal ™.

Signature Based and Anomaly Based Network Intrusion Detection - slide 1
01 / 10Signature Based and Anomaly Based Network Intrusion Detection
1 / 17

Télécharger la présentation

Signature Based and Anomaly Based Network Intrusion Detection
Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation

Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement. Téléchargez la présentation en cliquant sur ce lien. Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.

F I N

Plus de contenu associé

Transcription de la présentation

  1. Signature Based and Anomaly Based Network Intrusion Detection By Stephen Loftus and Kent Ho CS 158B

  2. Agenda • Introduce Network Intrusion Detection (NID) • Signature • Anomaly • Compare and Contrast:Signature based vs. Anomaly based NID • Example using Ethereal™

  3. Intrusion Detection Systems • Intrusion detection begins where the firewall ends. • Preventing unauthorized entry is best, but not always possible. • It is important that the system is reliable and accurate and secure.

  4. IDS (cont.) • When designing a IDS, the mission is to protect the data’s • Confidentiality- read • Integrity- read/write • Availability- read/write/access • Threats can come from both outside and inside the network.

  5. Signature • Signature based IDS are based on looking for “known patterns” of detrimental activity. • Benefits: • Low alarm rates: All it has to do is to look up the list of known signatures of attacks and if it finds a match report it. • Signature based NID are very accurate. • Speed: The systems are fast since they are only doing a comparison between what they are seeing and a predetermined rule.

  6. Signature (cont.) • Negatives: • If someone develops a new attack, there will be no protection. • “only as strong as its rule set.” • Attacks can be masked by splitting up the messages. • Similar to Anti-Virus, after a new attack is recorded, the data files need to be updated before the network is secure. • Example: • Port Scan • DOS • Sniffing

  7. Anomaly • Anomaly based IDS are based on tracking unknown unique behavior pattern of detrimental activity • Advantages: • Helps to reduce the “limitations problem”. • Conducts a thorough screening of what comes through.

  8. Anomaly (cont.) • Disadvantages: • False positives,catches too much because Behavior based NIDs monitor a system based on their behavior patterns. • Painstaking slow to do an exhaustive monitoring, uses up a lot or resourceAfter an anomaly has been detected, it may become a “signature”.

  9. Anomaly vs. Signature • Which is the best way to defend your network? • Both have advantages • Signature can be used as a stand alone system • Anomaly has a few weak points that prevent it from being a stand alone system. • Signature is the better of the two for defending you network • The best way is to use both!

  10. Example • Using Ethereal™ to detect a port scan • A port scan is when a person executes sequential port open requests trying to find an open port. Most of these come back with a “reset” • Normal TCP/IP port request • Port request on closed port