RE: Anomaly Based Network IDS

From: Sasha Romanosky (sasha_romanosky_at_yahoo.com)
Date: 06/24/04

  • Next message: Jeff Dell: "IDS Policy Manager 1.4 Released" 
    To: "'Joe Dauncey'" <secdistlist@dauncey.net>, <focus-ids@securityfocus.com>
Date: Wed, 23 Jun 2004 19:18:22 -0700

    A few comments inline.

    > I suppose my defintion of anomaly based is that it discovers
    > attacks based on sampling and analysing the network traffic
    > and identifying anomalies on the norm, rather than relying on
    > a specific external signature to tell it what to look for.

    In a nutshell, that's about right, yeah. But there are different kinds
    of anomaly-based detection systems:
    - Statistical anomaly: defines a baseline from observed activity and for
    each new event, determines its mathematical probability of occurrence.
    - Behavioral anomaly: measures (abnormal) user or application-type
    events
    - Flow-based anomaly: observes (abnormal) http or other session patterns
    - Protocol anomaly (as mentioned): defines an anomaly as a deviation
    from a prescribed standard of communication (e.g. RFCs)

    > I'm thinking that this would really have to be incredibly
    > sophisticated as it's going to vary for every network
    > environemtn, and could potentially generate a lot of false positives.

    Well it probably would vary for each environment, to the extent that
    each environment is different. The big claim of anomaly detection
    controls, in general, is that they have very low false positives
    specifically because of how they work.

    > I'm especially interested in anything that would claim to be
    > able to detect a worm attack (and even prevent it) without
    > knowing about it already - i.e. through a signature.

    Well, that's not really how to think about anomaly detection systems.
    They won't detect a worm any more than a web server banner, leave that
    to signature-based systems. The goal is to detect behavior that is
    "different enough" from a prescribed norm. Where "different enough"
    could result from dramatically increased (or decreased) traffic, user
    authentication from an irregular location, or a significant change in
    user behavior.

    Now, what is causing that aberrant behavior? Well, that's for you to
    find out. This is where correlation with a signature-based system comes
    in, as does a human. This isn't a failing of anomaly detection, just how
    it works. (Just as signature-based controls can't detect unknown
    attacks. Thus the reason they are used together.)

    Hope that helps.

    Cheers,
    sasha

    > I know that there have been a few Host-based IDS that make
    > this claim, but I'm looking for something that will look
    > after a network infrastructure, rather than a subset of
    > specific systems.

    > Any thoughts or comments?
    >
    > Thanks,
    > Joe Dauncey

    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------

  • Next message: Jeff Dell: "IDS Policy Manager 1.4 Released"

    Relevant Pages

    • RE: IPS comparison
      ... >It might if your DNS server doesn't normally do this. ... and anomaly detection. ... analysis tool for network traffic, netflow, firewall logs, host logs, .etc, ... but anomaly detection is just that -- anomalies. ...
      (Focus-IDS)
    • RE: IPS comparison
      ... >- maybe one day, the hard drive crashes, and all the network starts ... > doing DNS requests to the backup DNS server which looks like some ... >traffic, netflow, firewall logs, host logs, .etc, but anomaly detection ... That's why having a NADS to prioritize these anomalies could save you ...
      (Focus-IDS)
    • RE: Neural Net based Host/Application Anomaly detection systems
      ... Interesting enough however, anomaly detection is ... >> behavior on their given network. ... >> base data set is one way to solve the problem. ... >> anomalies on one network would be completely ...
      (Focus-IDS)
    • Re: Anomaly Based Network IDS
      ... Subject: Anomaly Based Network IDS ... > the network traffic and identifying anomalies on the norm, rather than relying on a specific external ... They can detect attacks ...
      (Focus-IDS)
    • Anomaly Based Network IDS
      ... I am interested in views on anomaly-based Network IDS. ... I know that at least Enterasys Dragon NIDS claims to be anomaly based. ... I suppose my defintion of anomaly based is that it discovers attacks based on sampling and analysing the network traffic and identifying anomalies on the norm, rather than relying on a specific external signature to tell it what to look for. ...
      (Focus-IDS)