信息安全(入侵檢測(cè))-在線瀏覽
2025-02-28 10:01本頁(yè)面
【正文】 systems, initiating incident handling procedures. ? Misuse detectors can only detect those attacks they know about , therefore they must be constantly updated with signatures of new attacks. ??Many misuse detectors are designed to use tightly defined signatures that prevent them from detecting variants of mon attacks. Disadvantages Snort Filtered packet stream libpcap ? Takes the “raw” packet stream ? Parses the packets and presents them as a – Filtered packet stream ? Library for packet capture ? Website for more details – Malicious Pattern Example alert tcp any any (content: “/cgibin/phf”。 msg: “PHF probe!”。分隔 選項(xiàng)關(guān)鍵字（ Options Keywords） 方向操作符：規(guī)則所施加的流的方向 :雙向操作符 Malicious Patterns Example ? content: “/cgibin/phf” – Matches any packet whose payload contains the string “/cgibin/phf” – Look at ? msg: “PHF probe!” – Generate this message if a match happens More Examples alert tcp any any :6010 (msg: “X traffic”。) 24： C類子網(wǎng) 16： B類子網(wǎng) 32：特定機(jī)器地址 目標(biāo)端口號(hào)在 6000到 6010范圍內(nèi) 對(duì)任何來(lái)自 ，發(fā)送到 ，目標(biāo)端口號(hào)在60006010范圍內(nèi)的 tcp流，在報(bào)警和日志中打印一條消息 How to generate new patterns? ? Buffer overrun found in Inter Message Access Protocol (IMAP) – ? Run exploit in a test work and record all traffic ? Examine the content of the attack packet Notional IMAP buffer overflow packet 05249922:27: :1034 :143 TCP TTL:64 TOS:0x0 DF ***PA* Seq: 0x5295B44E Ack: 0x1B4F8970 Win: 0x7D78 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 3B ...............。 msg:New IMAP Buffer Overflow detected!。在獲得 /etc/passwd文件的內(nèi)容時(shí)，我們不直接輸入 cat /etc/passwd等命令行，而是通過(guò)一個(gè)命令解釋器 (例 如： perl)來(lái)實(shí)現(xiàn)我們的目的： badguyhost$ perl –e ?$foo=pack(“C11”,47,101,116,99,47,112,97,115,115,119,100)。 print”bam\n”。顯然，防御這種攻擊就很困難了，因?yàn)檫@要求入侵檢測(cè)系統(tǒng)必 須能夠理解這種解釋器如何收到的命令。通過(guò)歸納學(xué)習(xí)產(chǎn)生這些規(guī)則集，并能動(dòng)態(tài)地修改系統(tǒng)中的這些規(guī)則，即預(yù)測(cè)準(zhǔn)確率較高與較高可信度的被保留下來(lái)。其規(guī)則形式如下： 其中 E1～ E 5表示安全事件。如果觀測(cè)到的事件序列與規(guī)則的左邊匹配，而后續(xù)的事件顯著地背離根據(jù)規(guī)則預(yù)測(cè)到的事件，那么系統(tǒng)就可以檢測(cè)出這種偏離，表明用戶操作異常。 ( 1 ! 2 ! 3 ) ( 4 95% , 5 5% )E E E E E??Only the first two measures are used in current mercial IDS. ??Detecting unusual behavior and symptoms of attacks without specific knowledge of details. ??Producing information that can in turn be used to define signatures for misuse detectors. Advantages ??Producing a large number of false alarms ??Often requiring extensive “training sets” of system event records in order to characterize normal behavior patterns. Disadvantages 使用 ROC ( Receiver Operator Characteristic ) 曲線能 夠很好地顯示不同入侵檢測(cè)方 法在采用不同閾值時(shí)的 性能。通常 ROC曲線的 X 軸代表 誤報(bào)率， Y 軸代表檢測(cè)率。 Response Options for IDS Once IDS have obtained event information and analyzed it to find symptoms of attacks, they generate responses. ? Active IDS responses are automated actions taken ? There are three categories of active responses: ?Collect additional information: The most innocuous, but at times most productive ?Change the Environment: reconfigure router,reset TCP inject ? Take Action Against the Intruder: this response is ill advised. Active Responses Passive Responses ? Provide information to system users, relying on humans to take subsequent action based on that information. ? Many mercial IDSs rely solely on passive responses. Deploying IDS Deployment Tips (1) ? Dual NIC – No TCP/IP binding – Network Performance ? NIC optimization settings ? Promiscuous mode Deployment Tips (2) ? Locations – DMZ – In front of firewall – Behind firewall – Server segments – “Power user” segments ??Sees attacks that perate the work’s perimeter defenses. ??Finding problems exiting in firewall policy or performance ??Sees attacks that might target the web server or ftp server, which monly reside in this DMZ ??Even if the ining attack is not recognized, the IDS can sometimes recognize the outgoing traffic that results from the promised server Location1: Behind each external firewall, in the
試題試卷相關(guān)推薦
鄂ICP備17016276號(hào)-1