Une image / un lien ci-dessous est fourni (tel quel) pour télécharger la présentation
Politique de téléchargement : le contenu du site vous est fourni TEL QUEL pour votre information et votre usage personnel ; il ne peut être vendu, concédé sous licence ni partagé sur d’autres sites sans l’accord de son auteur.Le contenu vous est fourni TEL QUEL, pour votre information et votre usage personnel uniquement.Téléchargez la présentation en cliquant sur ce lien.Lors du téléchargement, si vous ne parvenez pas à télécharger une présentation, l’éditeur a peut-être supprimé le fichier de son serveur.Pendant le téléchargement, si vous ne parvenez pas à obtenir une présentation, le fichier a peut-être été supprimé par l’éditeur.
網路攻擊種類 • Denial of Service (DoS), Distributed Denial of Service (DDoS) • Network Invasion • Network Scanning • Network Sniffing • Torjan Horse and Backdoors • Worm
(1) DoS/DDoS • Prevent another user from using network connection, or disable server or services: e.g. “Smurf” and “Fraggle” attacks, “Land”, “Teardrop”, “NewTear”, “Bonk”, “Boink”, SYN flooding, “Ping of death”, IGMP Nuke, buffer overflow. • Caused by protocol fault or program fault. • It damages the “Availability”.
一般常見的 DoS 攻擊 • Ping Flooding • 藉由傳送大量的 ICMP echo封包至受害主機，以耗盡系統資源。 • Ping of Death • 攻擊者傳送夾帶 65,536位元組的 ICMP echo封包至受害主機，而受害主機將因此而當機 (TCP/IP 協定實作漏洞)。 • UDP flooding (Chargen) • 攻擊者傳送大量的 UDP封包至受害網路廣播位址的十九埠（Port 19, Character Generator），造成此網路的所有主機皆送出回應的UDP封包，耗盡網路的頻寬。
Smurf attack (DoS) • Dangerous attacks • Network-based, fills access pipes • Uses ICMP echo/reply (smurf) or UDP echo (fraggle) packets with broadcast networks to multiply traffic • Requires the ability to send spoofed packets • Abuses “bounce-sites” to attack victims • Traffic multiplied by a factor of 50 to 200 • Low-bandwidth source can kill high-bandwidth connections • Similar to ping flooding, UDP flooding but more dangerous due to traffic multiplication
SYN flooding Attack (DoS) • Goal is to deny access to a TCP service running on a host. • Creates a number of half-open TCP connections which fill up a host’s listen queue; host stops accepting connections. • Requires the TCP service be open to connections from the victim.
SYN flooding (cont’d) SpoofedSYN ACK to spoofed address : : Attacker Victim The Innocents
DDoS Attack Attacker Handler Handler Handler Agent Agent Agent Agent Agent Agent Agent Control message Maybe encrypted or hidden in normal packets. Victim Spoofed packets.
(2) Network Invasion • Goal is to get into the target system and obtain information • Account usernames, passwords • Source code, business critical information • Usually caused by improper configurations or privilege setting, or program fault. • Network invasion is diverse and various, knowledge about attack pattern may help to detect, but it is quite hard to detect all attacks.
Example of network invasion: IIS unicode buffer overflow For IIS 5.0 on windows 2000 without this security patch, a simple URL string: http://address.of.iis5.system/scripts/..%c1%1c../winnt/system32/cmd.exe?/c+dir+c:\ will show the information of root directory.
(3) Network Scanning • Goal is generally to obtain the chance, the topology of victim’s network. • The name and the address of hosts and network devices. • The opened services. • Usually uses technique of ICMP scanning, X’mas scan, SYN-FIN scan, SNMP scan. • There is an automatic and powerful tool: Nmap.
(4) Sniffing • Goal is generally to obtain the content of communication • Account usernames, passwords, mail account • Network Topology • Usually a program placing an Ethernet adapter into promiscuous mode and saving information for retrieval later • Hosts running the sniffer program (e.g. NetBus) is often compromised using host attack methods.
(5) Backdoor and Torjan horse • Usually, the backdoor and torjan horse is the consequences of invasion or hostile programs. • It may open a private communication channel and wait for remote commands. • Available toolkits: • Subseven, • BirdSpy, • Dragger • It can be detected by monitoring known control channel activities, but not with 100% precision.
(6) Worm • The chief intention of worm is to propagate and survive. • It takes advantages of system vulnerabilities to infect and then tries to infect any possible targets. • It may decrease the production of system, leave back doors, steal confidential information and so on.
Intrusion Detection System • Intrusion Detection System: a computer system that attempts to detect any set of actions that try to compromise the integrity, confidentiality, or availability of a resource. • An IDS has much more knowledge and many delicate detection functions than common firewalls. (Remember that, the main function of a firewall is to do access control).
IDS Types • Host based vs. Network based. • Misused detection vs. Anomaly detection • Active vs. Passive • Centralized vs. Distributed
Host based & Network based IDS • Host based IDS: installed on target host as a monitor service. It checks system activity, user privilege, user behavior. • Network based IDS: installed on network node, usually in promiscuous mode to listen all passing traffic. It checks network traffic, nodes interactions.
Misused detection & Anomaly detection IDS • Misused detection (signature-based): based on the assumption that intrusion attempts can be characterized by the comparison of user activities against a database of known attacks. • Anomaly detection (statistical-based): identify abusive behavior by noting and analyzing audit data that deviates from a predicted norm.
Active IDS vs. Passive IDS • Active IDS: an participate in the system. Not only observe the events, but also involve in the necessary operation. Also called IPS or IDP (Intrusion Detection and Prevention System) • Passive IDS: work on a monitor or bystander basis.
ISP ISP 網路入 侵攻擊 被攔截 利用Port Mirror 收集封包分析 網路入 侵攻擊 可穿透 直接攔截 封包分析 Passive IDS Active IDS LAN LAN (a) Passive IDS (b) Active IDS Active IDS v.s. Passive IDS
Centralized IDS v.s. Distributed IDS • Centralized: The sensors are managed by a single analyzer or manager. • Distributed: The sensors are managed by multiple automated analyzers or managers. And among analyzers and managers, they can communicate to each other.
Comparison between Firewall and Network based active IDS • Same : • Can’t protect insider to insider attack. • Can’t protect against connections that don’t go through. • Can do ACL and filtering. (For Active IDS) • Different : • IDS has the ability to detect new threats. • IDS focuses on intrusion while Firewall focuses on access control and privacy. • Firewalls use address as the passport while IDS will do much more checks.
The Challenge of IDS • Speed limitation: NIDS cannot keep pace with the network speed. (NIDS need to check more fields of a packet than a firewall does.) • The inability to see all the traffic: The “switched Ethernet” is getting largely deployed. • Fail-open/fail-close architecture: when a NIDS fails often without notification of the problem to the central console., leave the network as an “open” one. A “fail-closed” methodology means the network is out of service until the NIDS is brought back on-line.
A Generic Layer-7 Engine • Packet Normalizer • Makes sure the integrity of incoming packets • Eliminates the ambiguity • Decodes URI strings if necessary • Pattern-Matching Engine • Policy Engine • Gather information from pattern-matching engine and issue the verdict to allow/drop the packets
Packet Normalizer • Integrity Checking • IP Fragment Reassemble • TCP Segment Reassemble • TCP Segments may come out-of-order • SEQ out of window size • Segment Overlapping • URI Decode • URI hex code obfuscation (‘a’ = %61) • URI unicode/UTF-8 obfuscation • self-referential directories obfuscation (/././././ = /) • directories obfuscation (/abc/a/../a/../a/ = /abc/a)
Pattern-Matching Engine • The most computation-intensive task in packet processing. Normally the PM engine needs to process every single byte in packet payload. • In Snort, the PM routine accounts for 31% of the total execution time
Pattern Matching Problem Definition • Given an input text T = t0, t1, …, tn ,and a finite set of strings P = {P1, P2, …, Pr}, the string matching problem involves locating and identifying the substring of T which is identical to Pj = , 1 j r, where ts+i = , 0 i m-1. And this equation can be also denoted as ts…ts+m-1 = Text
Aho-Corasick (AC) Algorithm • AC is a classic solution to exact set matching. It works in time O(n + m + z) where z is number of patterns occurrences in T. • AC is based on a refinement of a keyword tree. • AC is a deterministic algorithm. That is, the performance is independent of the number of patterns.
Connexion au compte
Connectez-vous pour publier votre contenu sur SlideServe.
