Intusion Detection Intercomponent Adaptive Negotiation 入侵检测组件间的自适应谈判.pptVIP

Report on Common Intrusion Detection Framework By Ganesh Godavari Outline of the talk CIDF GIDO GIDO Filters Goal Goal of IDIAN Develop a negotiation protocol that is dynamic Allow distributed collection of heterogeneous ID components Provide inter-operate ability to reach agreement on ID information processing capability Motivation Understand Common Intrusion Detection Framework Common Intrusion Specification Language (CISL) Scenario 1: a new capability new host machine with detection component is added to LAN. Network under connection laundering attack Solution ? solution Analysis component detects the number of inbound and outbound connections for the service provided by the host. Scenario 2: flooding IDS Stolen company laptop with detection component is used to launch an attack. Hacker generate lot of spurious audit data to deflect suspicion. Second host is also compromised. Generate more audit data and crash the central IDS Common Intrusion Detection Framework (CIDF) CIDF architecture Divides IDS into Components Component consists of software code with configuration information Components can be added/removed Components interact in real time and exchange data using GIDO CIDF components Components Event generators (E-boxes) Produce GIDOs Event analyzers (A-boxes) Consume GIDOs Conclusions are turned out as GIDOs Event databases (D-boxes) store events for later retrieval Response units (R-boxes) Consume GIDOs Take action like kill process, reset connections Generalized Intrusion Detection Objects (GIDO) GIDO consists of two components Fixed Format header CIDF version, timestamp, and length of body Variable Length Body data GIDO body (ByMeansOf (Attack (Observer (ProcessName `StackGuard) ) (Target (HostName `somehost.someplace.net) ) (AttackSpecifics (Certainty `100) (Severity `100) (AttackID `1 `0x4f) ) (Outcome (CIDFReturnCode `2) ) (When (BeginTime `14:57:36 24 Feb 1999) (EndTime `14:57:36 24 Feb 199