入侵检测规则基础知识.docx
《入侵检测规则基础知识.docx》由会员分享,可在线阅读,更多相关《入侵检测规则基础知识.docx(8页珍藏版)》请在冰豆网上搜索。
![入侵检测规则基础知识.docx](https://file1.bdocx.com/fileroot1/2023-2/3/2152b637-5939-44ab-8b68-367c7090b638/2152b637-5939-44ab-8b68-367c7090b6381.gif)
入侵检测规则基础知识
入侵检测规则基础知识(Basicknowledgeofintrusiondetectionrules)
Basicknowledgeofintrusiondetectionrules
Networkintrusiondetectionsystemrulereferstoapatternthatweneedtofindinnetworkcommunication.Inorderforyoutobedifferentfromeachother
Therulesofthetypehaveabasicconcept,solet'slookatsomeexamplesandmethodsthatcanbeusedtoidentify.
AconnectionrequestsentfromafixedIP.ThiscanbeeasilyidentifiedbytheoriginaladdressareaintheIPheaderfile.
AcollectionwithanillegalTCPtagpackage.ThiscanbedonethroughknownlegalandillegalcollectionoftagsandTCPheaderfiles
Themarkerscompareanddrawconclusions.
ContainsthespecialvirusE-mail.IDScanbeassociatedwithaknownvirusmessagebythenameofthemailorthenameoftheattachment
Thetitleofguaniscomparedandconcluded.
TheDNSbufferoverflowattemptisincludedinthequeuepayload.YoucananalyzetheDNSdomainandcheckthelengthofeachqueue
Degrees,sothatIDScantellifthereisabufferoverflowattemptintheDNSdomain.Oranotherway,
Tofindoutifthereisanoverflowprograminthepayloadqueue.
AdenialofserviceattackonaPOP3serverisimplementedbycommittingthousandsofidenticalcommands.Thewaytodealwiththisattack
Itisthenumberoftimesthatthecommandiscommitted,andthealarmwillbeissuedoncemorethanthenumberoftimesitisset.
FileaccessattacksonFTPserversbysubmittingfilesordirectoriestotrytoskipthepreviousloginprocess.Youcanopen
SendatrackingsystemtomonitorthesuccessfullandingofFTPcommunicationsifyoufindsomeonetryingtoadvancethroughthesystem
Incoming,thealarmwillbeissued.
Asyoucanseefromabove,thescopeoftheruleisverybroad,fromthesimplestcheckheadertohighlycomplex,forexample
Truetrackingofconnectionstatusorextensiveprotocolanalysis.Inthisarticle,we'lllookatsomesimplerules,andthen
Discusstheircomplexityindevelopment.NotethattheabilityoftherulechangesindifferentIDS,sothisarticle
Thetechniquesdescribedmaynotbeapplicableinthefirewallyouuse.Forexample,somenetworkIDSproductsareprovidedtocustomers
Theabilitytowriterulesorconfigureexistingrulesisweak,andthereareproductsthatalmostallowyoutocustomizealltheexistingrules
Anddefinealltherulesthatyoucanthinkofinthesystem.AnotherimportantfactortoconsiderissomeIDSproducts
Youcancheckthepayloadpropertiesofaspecificheaderfile,andsomeproductscangiveyoudataonanypartofanypackage.
Whatarethefunctionalservicesoftherule
Whatisthepurposeofintrusiondetectionrules?
Theansweristhatdifferentruleshavedifferentpurposes.Theresultsweneed
Whenanintrusionoccurs,thesystemalertsyou.Butlet'sthinkagain,whydoweneedtocustomizeormodifyourownrules
Then?
Youmayseesomesinglecommunicationonthenetwork,andyouwanttoalertthenexttimesuchacommunicationoccurs.
Youmayhavenoticedthatithasaspecialheaderfile,andyouwanttodefinearuletomatchthisknown
Mark;MaybeyouwanttoconfigureIDStodetectthosethingsthatarenotnormalorsuspicious,
Ratherthandetectingattacksandattacks
Detection.Somerulescantellyouwhichspecificattacksarebeingcarriedout,orifanattackeristryingtotargetavulnerability
Whileotherrulesmerelyindicatethatthereisanabnormalbehavior,ratherthanpointingoutwhichattacksarespecific.Theformerisboundtoflower
Spendmoretimeandresources,butcangiveyoumoreinformation,suchaswhyareyouattackedortheattacker'spurpose
Yao.
Headerfileattribute
Wehavequicklydescribedthetypesofrules,andthenlet'slookatasimplerulefeature:
headerfileproperties.a
Someheaderfileattributesareclearlyabnormal,sowehavetomakealotofoptionsintherules.Theclassicexampleofthisruleisthebelt
TCPpackageSettingswithSYNandFINflags.ThereisoneinRFC793(usedtodefinetheTCPstandard)
Aloopholethatallowsmanytoolstotrytobypassthefirewall,router,andintrusiondetectionsystem.very
Themulti-attackprogramincludesheaderfileattributeswhosepurposeistoviolateRFCsbecausemanyoperatingsystemsandapplicationsarebased
CompliancewithRFCsassumptionsanderrorsincommunicationbasedonthisarenotcorrected.Therearealotofkitsoutthere
Containserrorsorincompletecode,andpackagesmadefromthesetoolscontaintheheaderfileattributesthatviolateRFCs.
Thosepoorlywrittentoolsandvariousintrusiontechniquesprovidediscernibleattributesforwritingrules.
Thissoundsgood,butnotethatnotalloperatingsystemsandapplicationsarefullyinheritedfromRFCs.things
Infact,manysystemsorprogramsviolateRFCatleastontheonehand.So,withthepassageoftime,theagreementispossible
NewattributesarenotincludedintheRFC,andthennewstandardsemerge,turningpreviouslyunjustifiedstandardsintothepresent
Themethod.RFC3168isagoodexample.So,therulesofIDSarecompletelydependentontheRFC
Thatleadstoalotofpositiveerrors.Ofcourse,RFCisstillasignificantpartoftheruledevelopmentbecauseofalotofmalice
TheattackswereallaimedatRFCs.DuetotheRFCupgradeandotherfactors(whichwewilldiscusslater),
Soyouneedtoreviewandupgradeexistingrulesperiodically.
Whileanillegalheaderfileattributeisabasiccomponentoftherule,itisalsoimportanttohavelegitimatebutsuspectheaderproperties.Forexample,
Forconnectionsuspiciousportssuchas31337or27374(theseareoftenassociatedwithTrojanports),ifthisisthecase
ThelinkwarnsthattheTrojanhorsecanbequicklyidentified.Unfortunately,somenormalandbenigncommunicationmayalsobeusedthesame
Theport.Ifyoudon'tusemoredetailedrulestodefinetheotherfeaturesofthecommunication,youwillfinditdifficulttodeterminethetruenatureofthecommunication
Sex.Suspiciousbutlegalproperties,suchassomeportNumbers,arebestconsideredwithotherattributes.
Identifypossiblerulecomponents
Thebestwaytodeveloprulesbasedontheheaderfileattributesisthroughaninstance.Synscanisawidelyusedsweep
Traceandprobesystemtools.
Itwasactiveinearly2001becauseitscodewasoftenusedtomakeit
ThefirststageofbuildingRamenworms.Thisactivityprovidesagoodexample,becausethepackagecontainsalotofknowledge
Don'tcharacteristics.HerearesomeoftheIPandTCPheaderfilesthatexistintheearlywormpropagationintheRamenwormpacket
Sex.(notethatmyIDSisconfiguredtocancelunrequestedcommunicationbydefault,soIcanonlyseeeachattempt
Initialpackage)
1varioussourceIPaddresses
2TCPsourceport21,targetport21
Theservicetypeis0
4IPidentificationnumber39426
5SYNandFINtagSettings
6variousserialnumberSettings
VariousconfirmationnumberSettings
8TCPWindowssizeis1028
NowthatweknowthefeaturesoftheSynscanpackage'sheaderfile,wecanstartthinkingabouthowtomakeagoodone
Therules.Let'slookforillegal,abnormal,andsuspectattributesthatareinmanycases
Thecorrespondingattackertriestoexploitvulnerabilitiesoraspecialtechniqueusedbytheattacker.Althoughnormalpackagepropertiesareincluded
Itoftenincludesrestrictionsonsomecommunications,butthisrestrictiondoesnotmakeforgoodrulecharacteristics.Forexample,wewillmaketheagreement
ThenormalIPprotocolattributeisdefinedas6,sowecanonlylookattheTCPpacket.Butothersareperfectlynormal
Features,suchassettingtheservicetypeto0,areverydetrimentaltothedevelopmentoftherules.
SomeunusualfeaturesoftheSynscanpackagecanbeidentifiedusingthefollowingrules:
OnlytheSYNandFINmarkersareclearlymarkedformaliciousbehavior.
2anotherfeatureisthatthesepacketshavedifferentpropertiesbuttheACKflagisnotset.Ifyoudon'thaveSettings
TheACKmark,theconfirmationnumbershouldbesetto0.
Thereisalsoasuspiciousfeaturethatbothsourceandtargetportsaresetto21,whichisanabnormalFTPserver
Theagentisassociated.IfthetwoportNumbersarethesame,wecallthemreflexive.Inadditiontosomespecialcommunications(suchasspecificNe
TBIOScommunications,usuallyshouldnotexist.Theanti-bodyportdoesnotviolatetheTCPstandard,butismostly
Thenumberofeventsisabnormal.InnormalFTPcommunication,wewillseeahighend(greaterthan1023)
Asthesourceport,thetargetportis21.
Inthisway,wefoundthreefeaturesthatcanbeusedtomaketherules:
SYNandFINmarkers,andtheconfirmationnumberisnot
0andnoACKtagsareset,andthereflexiveportissetto21.Twothingstonotehere:
TCPw
Theindowssizeisoftensetto1028andtheIPidentificationnumbersetsallpackages39426.Usually,we
TheexpectedTCPWindowssizeisgreaterthan1028,althoughthisvalueisnotveryabnormal,butitisalso
Shouldbenoticed.Inthesameway,
IPRFCdefinesIPidentificationNumbersthatshouldhavedifferentvaluesindifferentpackages,so
Fixedvaluesarehighlyquestionable.
Choosearule
Sincewehavefoundfiveelementsthatcanbearule,wehaveanumberofdifferentoptionstodevelopbasedonheaders
Therulesofafile,andagoodruleshouldincludemorethanonefeature.Ifyoujustwanttosetthesimplestrules,then
YoucanusepackagesofSYNandFINtagstosetup.Althoughthisisabetterwaytoidentifybadbehavior,itcan't
Giveareasonwhythishappens.RememberthatSYNandFINareusuallyusedtobypassfirewallsandotherdevices
Theycanactasascanner,informationcollectionorattack.So,the