coen252computerforensics(存儲(chǔ)版)
【正文】 re very sophisticated. Intrusion Detection Basics ? Intrusions have “signatures” ? Examples ? Directory Traversal Vulnerability ? Solaris Sadmind/IIS worm (2020) ? Allowed HTTP GET requests to change to root directory with “../../”. ? Allowed to copy into the Scripts directory. ? Gained control usually at admin level GET/ scripts/../../winnt/system32/ /c+ copy+\wint\system32\+ Intrusion Detection Basics ? Code Red Worm 2020 ? Exploited vulnerability in IIS and ? Buffer overflow vulnerability ? Footprint: /?NNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNNN%u9090%u6858%ucbcd3%7801%u9090%u6805%ucbd3%u7801 Intrusion Detection Basics ? Most known attacks have an attack signature. ? Sequence of bytes that characterize an attack packet almost for sure. ? Intrusion Detection System can look for footprints, drop the packet, and raise an alert. Intrusion Detection Basics ? IDS ? Firewall ? Firewall needs to process all packets. ? Filtering capacity at firewall limited by need to deliver packets in timely manner. ? IDS can take its time. ? IDS does not drop packets, but sends alerts and logs. Intrusion Detection Basics ? Intrusion Detection System can be deployed ? Network IDS (behind the firewall and internal router.) ? Host based IDS (at all hosts) ? Distributed IDS (throughout the local work at strategic locations) Snort: Architecture ? Sniffer ? Preprocessor ? Detection Engine ? Alert Logging Snort Architecture SNORT Architecture ? Packet Sniffer ? Taps into work ? Preprocessor ? Checks against plugins ? RPC plugin ? Port scanner plugin ? … SNORT Architecture ? Detection Engine ? Snort is a signaturebased IDS ? Implemented via rulesets ? Rules ? Consists of rule header ? Action to take ? Type of packet ? Source, destination IP address ? … ? And rule option ? Content of package that should make the packet match the rule SNORT Architecture ? Snort Alerting ? Ining “interesting packets” are sent to log files. ? Also sent to variou
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號(hào)-1