INFOSEC Technologies, LLC
Counter-Terrorism/Counter-Espionage and Information Assurance Consulting

Intrusion Detection

Intrusion Detection is as much an art as it is a science. As the references here indicate, there are a number of tools available for this purpose. Fundamentally, there are two main types of intrusion detection systems, namely, network-based and host-based systems. Hybrid systems contain components and characteristics of the two types. Each has their benefits and limitations.

In general, there are two types of architectures for network-based intrusion detection systems. One is the sensor-based architecture. The other is the distributed network-node architecture. Both types of architectures contain network sensor and central command console. The differences between them lie in the location of detection engine, local response subsystem, and the alerting subsystem.

Network-Based Intrusion Detection Systems

A network-based intrusion detection engine processes a stream of time sequential TCP/IP packets to detect predetermined sequences and patterns. These patterns are known as signatures.

By observing patterns of behavior, suspicious activity may be detected to tip-off the operator that misuse may be occurring. The defining characteristic for tip-off is that the system is detecting something previously unsuspected. Surveillance usually follows a tip-off. During surveillance, targets are observed more closely for patterns of misuse.

Network-based intrusion systems can be used to deal with outside threat detection. It has the function of deterrence. It can also provide automated response.

However, packet loss on high-speed network, switched networks, encryption, and sniffer detection programs are challenges for network-based intrusion detection systems.

Host-Based Intrusion Detection Systems

Host-base intrusion detection systems are used to analyze data that originates on computer hosts, such as application and operating system event logs. Host event logs contain information about specific file accesses and program executions, usually associated with an authenticated, or inside user.

There are two types of architectures for host-based intrusion detection systems. One is the centralized host-based intrusion detection system. The other is the distributed real-time host-based intrusion detection system.

Both types of architectures contain target and command console. The differences between them lie in the location of detection engine, local response subsystem, and the alerting subsystem.

Target agents are small executables that run with privilege on target systems. Autonomous agents move from system to system on their own looking for misuse. Agent-less, host-based intrusion detection system performs host-based actions from a central location through an API that provides remote control of the data source.

There are four operational modes for host-based intrusion detection. They are tip-off, surveillance, damage assessment, and compliance.

Since policies drive the operation of an intrusion detection system, effective policy management can reduce performance degradation and resource costs. Audit policies and detection policies have to be fine tuned to meet the needs in specific environments.

Data sources are the heart of any host-based intrusion detection system. They include operating system logs, application logs, and middleware logs.

Host-based intrusion detection systems have the function of deterrence. It can detect threats. It can provide notification and response when a misuse is detected. It can also provide damage assessment, attack anticipation, and prosecution support.

However, performance, deployment, maintenance, threats of compromise, and spoofing are the challenges for host-based intrusion detection systems.

Both network-based intrusion detection systems and host-based intrusion detection systems are needed for different environments. Both of them have limitations. They all need further improvement.

On Intrusion Detection:

Aviel D. Rubin, White-Hat Security Arsenal: Tackling the Threats, Addison Wesley, 2001.
Brian Caswell, et al, Snort 2.0 Intrusion Detection, Syngress, 2003.
Chris Prosise, Incident Response: Investigating Computer Crime, McGraw-Hill, 2001.
Chris Prosise and Kevin Mandia, Incident Response and Computer Forensics, McGraw-Hill, 2001.
Edward Amoroso, Intrusion Detection: An Introduction To Internet Surveillance, Correlation, Trace back, Traps and Response, Intrusion.Net Books, 2000.
Eugene Schultz, Jim Mellander and Carl F Endorf, Intrusion Detection, McGraw-Hill, 2003.
Keith J Jones, et al, Anti-Hacker Toolkit, McGraw-Hill, 2002.
Kenneth R. Van Wyk and Richard Forno, Incident Response, O’Reilly, 2001.
Mark Cooper, Intrusion Signatures and Analysis, Que, 2001.
Rebecca Gurley Bace, Intrusion Detection, Que, 1999.
Stephen Northcutt, Inside Network Perimeter Security: The Definitive Guide to Firewalls, Virtual Private Networks (VPNs), Routers, and Intrusion Detection Systems, Que, 2002.
The HoneyNet Project, Know Your Enemy: Revealing the Security Tools, Tactics, and Motives of the Blackhat Community, Addison Wesley, 2001.