PDF p.255
In progress
IDS and IPS Detection Methods
Summary
PDF p.255Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) use various methods to detect and respond to suspicious network traffic. These methods include signature-based detection, behavioral-based detection, anomaly-based detection, and trend analysis.
In plain words
Supplementary — not from your PDFSignature-based detection matches known attack patterns. It's accurate for known threats but needs constant updates and misses new ones. Behaviour-based detection learns what's normal and flags deviations, so it can catch zero-days and insider misuse, but it produces more false positives. Anomaly-based detection looks for protocol irregularities, such as traffic that breaks RFC standards. UEBA and NTA are behavioural products. Trend analysis over time helps tune rules and cut false positives.
Detailed explanation
PDF p.255- Analysis Engine: Scans and interprets traffic to identify suspicious activities. It classifies events as ignore, log only, alert, or block (for IPS).
Detection Methods
-
Signature-Based Detection
- Description: Uses a database of known attack patterns or signatures.
- Updates: Requires regular updates to protect against new threats.
- Example: Snort rules file from Emerging Threats community feed.
-
Behavioral- and Anomaly-Based Detection
-
Behavioral-Based Detection
- Description: Recognizes baseline "normal" traffic and flags deviations.
- Capabilities: Identifies zero-day attacks, insider threats, and other anomalies.
-
Anomaly-Based Detection
- Description: Looks for irregularities in protocol usage and deviations from RFC standards.
- NBAD Products: Use heuristics to model normal traffic and detect anomalies.
- Machine Learning: Enhances detection capabilities in modern products.
-
Behavioral-Based Detection
Behavioral-Based Detection Products
- User and Entity Behavior Analytics (UEBA): Scans multiple sources to identify anomalies, often integrated with SIEM platforms.
- Network Traffic Analysis (NTA): Applies analysis techniques to network streams.
Trend Analysis
- Purpose: Helps understand the environment over time, identifying patterns, anomalies, and potential threats.
- Benefits: Aids in tuning IDS/IPS systems, reducing false positives, and focusing on significant alerts.
- Operational Security: Identifies common threats and targeted systems, guiding security policy changes and investments.
Important terms
taken from the text above- Analysis Engine
- Scans and interprets traffic to identify suspicious activities. It classifies events as ignore, log only, alert, or block (for IPS).
- Signature-Based Detection
- Uses a database of known attack patterns or signatures.
- Updates
- Requires regular updates to protect against new threats.
- Behavioral-Based Detection
- Recognizes baseline "normal" traffic and flags deviations.
- Capabilities
- Identifies zero-day attacks, insider threats, and other anomalies.
- Anomaly-Based Detection
- Looks for irregularities in protocol usage and deviations from RFC standards.
- NBAD Products
- Use heuristics to model normal traffic and detect anomalies.
- Machine Learning
- Enhances detection capabilities in modern products.
- User and Entity Behavior Analytics (UEBA)
- Scans multiple sources to identify anomalies, often integrated with SIEM platforms.
- Network Traffic Analysis (NTA)
- Applies analysis techniques to network streams.
- Operational Security
- Identifies common threats and targeted systems, guiding security policy changes and investments.
IDS Intrusion Detection Systems
IPS Intrusion Prevention Systems
UEBA User and Entity Behavior Analytics
NTA Network Traffic Analysis
Examples & real-world scenarios
Supplementary — not from your PDF- Updating Snort rules from the Emerging Threats feed.
- UEBA flagging a user downloading 50 times their normal volume.
- Tuning a noisy rule after trend analysis.
Scenario
A brand-new piece of malware has no signature yet, but it makes a server contact hundreds of hosts at 3 a.m. A behaviour-based system flags the deviation from baseline even without a signature.
Common mistakes
Supplementary — not from your PDF- Thinking signature-based detection catches zero-days.
- Deploying behavioural detection without establishing a baseline first.
Practical skills
Supplementary — not from your PDF- Compare signature, behaviour and anomaly detection for a scenario.
What I should remember
Key Points PDF p.255-
Signature-Based Detection
- Pattern Matching: Matches traffic against known attack signatures.
- Regular Updates: Essential for protection against new threats.
-
Behavioral- and Anomaly-Based Detection
- Baseline Recognition: Flags deviations from normal traffic.
- Heuristics and Machine Learning: Improve detection accuracy.
-
Trend Analysis
- Pattern Identification: Tracks events and alerts to identify ongoing threats.
- System Tuning: Reduces false positives and focuses on critical alerts.