AWaveletApproachtoNetworkIntrusionDetection课件.pptVIP

Secure IT - 2005 A Wavelet Approach to Network Intrusion Detection W. Oblitey S. Ezekiel IUP Computer Science Dept. Intrusion Detection: Provides monitoring of system resources to help detect intrusion and/or identify attacks. Complimentary to blocking devices. Insider attacks. Attacks that use traffic permitted by the firewall. Can monitor the attack after it crosses through the firewall. Helps gather useful information for Detecting attackers, Identifying attackers, Reveal new attack strategies. Classification: Intrusion Detection Systems classified according to how they detect malicious activity: Signature detection systems Also called Misuse detection systems Anomaly detection systems Also classified as: Network-based intrusion detection systems Monitor network traffic Host-based intrusion detection systems. Monitor activity on host machines Signature Detection: Achieved by creating signatures: Models of attack Monitored events compared to models to determine qualification as attacks. Excellent at detecting known attacks. Requires the signatures to be created and entered into the sensor’s database before operation. May generate false alarms (False Positives). Problem: Needs a large number of signatures for effective detection. The database can grow very massive. Anomaly Detection: Creates a model of normal use and looks for activity that does not conform to the model. Problems with this method: Difficulty in creating the model of normal activity If the network already had malicious activity on it, is it ‘normal activity’? Some patterns classified as anomalies may not be malicious. Network-Based IDS By far the most commonly employed form of Intrusion Detection Systems. To many people, “IDS” is synonymous with “NIDS”. Matured more quickly than the host-based equivalents. Large number of NIDS products available on the market. Deploying NIDS Points to consider: Where do sensors belong in the network? What is to be protected th