NETWORK SECURITY USING INTRUSION DETECTION & PREVENTION SYSTEM INTEGRATION MODEL

Computer networks are now necessities of modern organisations and network security has become a major concern for them.Intrusion Detection Systems (IDS) are increasingly a key part of system defence. Various approaches to Intrusion Detection (ID)are currently being used but they are relatively ineffective when used in isolation. Also, numerous other threats have emergedrecently that are particularly troublesome, hence, some solution must be provided to encounter the new generation of complexthreats. Building up this solution requires the integration of different security devices and technologies. This study proposed anintegration model of combining different intrusion detection and prevention system (IDPS) technologies together with othertechnologies with IDPS capabilities for systems security and provide guide to integrate the multiple IDPS technologies. Thisintegrated approach allows systems managers to make more informed decisions regarding intrusion detection.Keywords: Intrusion detection system, Multiple IDPS, Integration, IDPS Technologies

Scalable data analytics pipeline for real-time attack detection: design, validation, and deployment in a honeypot environment

This work explores a scalable data analytics pipeline for real-time attack detection through the use of customized honeypots at the National Center for Supercomputing Applications (NCSA). Attack detection tools are common and are constantly getting improved, but validating these tools is challenging. One must automate how to identify what data is essential to detecting the attack, extract this data from multiple different monitors, and send this data to the attack detection tool. On top of this, one must be able to efficiently scale with an ever-increasing amount of data, while also having the ability to extend to new monitors. This requires an infrastructure that is non-trivial to create or to deploy. In this work, we present a generalized architecture that aims for a real- time, scalable, and extensible pipeline that can be deployed in diverse in- frastructures to validate arbitrary attack detection tools. To demonstrate our architecture, we will show an example deployment of our pipeline using completely open-sourced tools. Our example deployment uses as its sources: 1) a customized honeypot environment at NCSA, and 2) customized attack scripts written to follow the skeleton of canonical credential-stealing attacks. To extract useful information, we have deployed network and host-based monitoring tools such as Bro and OSSEC. We have also built an attack de- tection tool named AttackTagger that we will use as our front-end detection engine

Darknet as a Source of Cyber Threat Intelligence: Investigating Distributed and Reflection Denial of Service Attacks

Cyberspace has become a massive battlefield between computer criminals and computer security experts. In addition, large-scale cyber attacks have enormously matured and became capable to generate, in a prompt manner, significant interruptions and damage to Internet resources and infrastructure. Denial of Service (DoS) attacks are perhaps the most prominent and severe types of such large-scale cyber attacks. Furthermore, the existence of widely available encryption and anonymity techniques greatly increases the difficulty of the surveillance and investigation of cyber attacks. In this context, the availability of relevant cyber monitoring is of paramount importance. An effective approach to gather DoS cyber intelligence is to collect and analyze traffic destined to allocated, routable, yet unused Internet address space known as darknet. In this thesis, we leverage big darknet data to generate insights on various DoS events, namely, Distributed DoS (DDoS) and Distributed Reflection DoS (DRDoS) activities. First, we present a comprehensive survey of darknet. We primarily define and characterize darknet and indicate its alternative names. We further list other trap-based monitoring systems and compare them to darknet. In addition, we provide a taxonomy in relation to darknet technologies and identify research gaps that are related to three main darknet categories: deployment, traffic analysis, and visualization. Second, we characterize darknet data. Such information could generate indicators of cyber threat activity as well as provide in-depth understanding of the nature of its traffic. Particularly, we analyze darknet packets distribution, its used transport, network and application layer protocols and pinpoint its resolved domain names. Furthermore, we identify its IP classes and destination ports as well as geo-locate its source countries. We further investigate darknet-triggered threats. The aim is to explore darknet inferred threats and categorize their severities. Finally, we contribute by exploring the inter-correlation of such threats, by applying association rule mining techniques, to build threat association rules. Specifically, we generate clusters of threats that co-occur targeting a specific victim. Third, we propose a DDoS inference and forecasting model that aims at providing insights to organizations, security operators and emergency response teams during and after a DDoS attack. Specifically, this work strives to predict, within minutes, the attacks’ features, namely, intensity/rate (packets/sec) and size (estimated number of compromised machines/bots). The goal is to understand the future short-term trend of the ongoing DDoS attacks in terms of those features and thus provide the capability to recognize the current as well as future similar situations and hence appropriately respond to the threat. Further, our work aims at investigating DDoS campaigns by proposing a clustering approach to infer various victims targeted by the same campaign and predicting related features. To achieve our goal, our proposed approach leverages a number of time series and fluctuation analysis techniques, statistical methods and forecasting approaches. Fourth, we propose a novel approach to infer and characterize Internet-scale DRDoS attacks by leveraging the darknet space. Complementary to the pioneer work on inferring DDoS activities using darknet, this work shows that we can extract DoS activities without relying on backscattered analysis. The aim of this work is to extract cyber security intelligence related to DRDoS activities such as intensity, rate and geographic location in addition to various network-layer and flow-based insights. To achieve this task, the proposed approach exploits certain DDoS parameters to detect the attacks and the expectation maximization and k-means clustering techniques in an attempt to identify campaigns of DRDoS attacks. Finally, we conclude this work by providing some discussions and pinpointing some future work

Distributed Analysis of SSH Brute Force and Dictionary Based Attacks

When designing and implementing a new system, one of the most common misuse cases a system administrator or security architect anticipates is the fact that their system will be attacked with brute force and dictionary-based methods. These attack vectors are commonplace and as such, common defenses have been designed to help mitigate a successful attack. However, the common defenses employed are anticipated and mitigated by even the most novice of attackers. In order to better understand that nature and evolution of brute-force and dictionary attacks, research needs to evaluate the progression of the attack vectors as well as new variables to identify the risk of systems. The research that follows is designed to look at brute force and dictionary-based attacks from a geographical standpoint. Specifically, the data gathered will be analyzed to define attack anomalies based on date, time, location, operating system, and attacking clients in order to ascertain if such variables are viable attack indication markers for defense purposes

Analyzing IDS botnets detection

Mestrado de dupla diplomação com a UTFPR - Universidade Tecnológica Federal do ParanáIn a world increasingly connected with equipment permanently attached, the risk of cybersecurity had rise. Among the various vulnerabilities and forms of exploitation, the Botnets are those being addressed in this work. The number of botnets related infections has grown critically and, due to botnets’ increased capacity and potential use for future infections, a continued development of solutions is needed to strengthen the protection of networks and systems. Intrusion Detection Systems (IDS) are one of the solutions that try to follow this evolution. The continuous evolution of tools and attack forms in order to evade detection, using mechanisms such as encryption (IPSec, SSL) and diverse architecture and different ways of implementing Botnets create great challenges to those who try to detect them. In order to better understand these challenges, this work proposes an architecture to map the behavior of botnets. For this, a topology was created with several components, such as Network Intrusion Detection System (NIDS) and Host Intrusion Detection System (HIDS), aided with information from honeypots for the detection and analysis of attacks. This approach enabled real data to be obtained from attempts, some successfully, from Malware infections, with the aim of transforming systems into Bots and integrating them into Botnets. An exploratory analysis of the data is performed to verify the detection capabilities and the cases where the components do not provide correct information. Some methods based on machine learning were also used to process and analyze the collected data.Num mundo cada vez mais conectado com cada vez mais equipamentos ligados em permanência o risco de cibersegurança tem aumentado. De entre as diversas vulnerabilidades e formas de exploração continuada as Botnets são as visadas neste trabalho. Os números de infeções relacionadas com as Botnets têm crescido de forma critica e devido dotar de maiores capacidades os atacantes e seu grande poder de infeção futura é necessário um desenvolvimento continuo de soluções para reforçar a proteção das redes e sistemas. Os Sistemas de Deteccao de Intrusao (IDS) são uma das soluções que tentam acompanhar esta evolução deste tipo de ameaça. A evolução continua das ferramentas e formas de ataque por forma a fugir à detecção, utilizando mecanismos como tráfego cifrado (IPSec, SSL) e arquitectura diversa e formas diferentes da implementação das Botnets levantam grandes desafios a quem as tenta detectar. Por forma a compreender melhor estes desafios, este trabalho propõe uma arquitetura para mapear o comportamento das Botnets. Para isso criou-se uma topologia com diversos componentes, como Network Intrusion Detection System (NIDS) e Host Intrusion Detection System (HIDS), auxiliados com informação de honeypots para a deteção e análise de ataques. Esta abordagem permitiu obter dados reais de tentativas, algumas com sucesso, de infeções de Malware, com o intuito de transformar os sistemas em Bots e os integrar em Botnets. É efetuada uma análise exploratória dos dados para verificar a capacidade de deteção e os casos em que os sistemas não fornecem informação correta. Foram também utilizados alguns métodos baseados em machine learning para tratamento e análise dos dados coletados

Web attack risk awareness with lessons learned from high interaction honeypots

Tese de mestrado, Segurança Informática, Universidade de Lisboa, Faculdade de Ciências, 2009Com a evolução da web 2.0, a maioria das empresas elabora negócios através da Internet usando aplicações web. Estas aplicações detêm dados importantes com requisitos cruciais como confidencialidade, integridade e disponibilidade. A perda destas propriedades influencia directamente o negócio colocando-o em risco. A percepção de risco providencia o necessário conhecimento de modo a agir para a sua mitigação. Nesta tese foi concretizada uma colecção de honeypots web de alta interacção utilizando diversas aplicações e sistemas operativos para analisar o comportamento do atacante. A utilização de ambientes de virtualização assim como ferramentas de monitorização de honeypots amplamente utilizadas providencia a informação forense necessária para ajudar a comunidade de investigação no estudo do modus operandi do atacante, armazenando os últimos exploits e ferramentas maliciosas, e a desenvolver as necessárias medidas de protecção que lidam com a maioria das técnicas de ataque. Utilizando a informação detalhada de ataque obtida com os honeypots web, o comportamento do atacante é classificado entre diferentes perfis de ataque para poderem ser analisadas as medidas de mitigação de risco que lidam com as perdas de negócio. Diferentes frameworks de segurança são analisadas para avaliar os benefícios que os conceitos básicos de segurança dos honeypots podem trazer na resposta aos requisitos de cada uma e a consequente mitigação de risco.With the evolution of web 2.0, the majority of enterprises deploy their business over the Internet using web applications. These applications carry important data with crucial requirements such as confidentiality, integrity and availability. The loss of those properties influences directly the business putting it at risk. Risk awareness provides the necessary know-how on how to act to achieve its mitigation. In this thesis a collection of high interaction web honeypots is deployed using multiple applications and diverse operating systems in order to analyse the attacker behaviour. The use of virtualization environments along with widely used honeypot monitoring tools provide the necessary forensic information that helps the research community to study the modus operandi of the attacker gathering the latest exploits and malicious tools and to develop adequate safeguards that deal with the majority of attacking techniques. Using the detailed attacking information gathered with the web honeypots, the attacking behaviour will be classified across different attacking profiles to analyse the necessary risk mitigation safeguards to deal with business losses. Different security frameworks commonly used by enterprises are analysed to evaluate the benefits of the honeypots security concepts in responding to each framework’s requirements and consequently mitigating the risk

Framework for botnet emulation and analysis

Criminals use the anonymity and pervasiveness of the Internet to commit fraud, extortion, and theft. Botnets are used as the primary tool for this criminal activity. Botnets allow criminals to accumulate and covertly control multiple Internet-connected computers. They use this network of controlled computers to flood networks with traffic from multiple sources, send spam, spread infection, spy on users, commit click fraud, run adware, and host phishing sites. This presents serious privacy risks and financial burdens to businesses and individuals. Furthermore, all indicators show that the problem is worsening because the research and development cycle of the criminal industry is faster than that of security research. To enable researchers to measure botnet connection models and counter-measures, a flexible, rapidly augmentable framework for creating test botnets is provided. This botnet framework, written in the Ruby language, enables researchers to run a botnet on a closed network and to rapidly implement new communication, spreading, control, and attack mechanisms for study. This is a significant improvement over augmenting C++ code-bases for the most popular botnets, Agobot and SDBot. Rubot allows researchers to implement new threats and their corresponding defenses before the criminal industry can. The Rubot experiment framework includes models for some of the latest trends in botnet operation such as peer-to-peer based control, fast-flux DNS, and periodic updates. Our approach implements the key network features from existing botnets and provides the required infrastructure to run the botnet in a closed environment.Ph.D.Committee Chair: Copeland, John; Committee Member: Durgin, Gregory; Committee Member: Goodman, Seymour; Committee Member: Owen, Henry; Committee Member: Riley, Georg