Stay Current


Dive Into Intrusion Detection


By the IT Security Staff on March 8th, 2007

What Is Intrusion Detection?

If you check the references of most of the recent articles on intrusion detection, you will see that many of the core methodologies date back to the mid-to-late 1980s, before the public Internet. That was back when most intruders were probably high school kids or college students just flexing their mental muscles. They might crack into a network and change a few files or just leave a sort of calling card to claim bragging rights. Usually, they didn't do anything serious, except in movies.

Related Articles

That quickly changed when public Internet became commercially popular in the early 1990s. Today, threats pose serious financial and legal issues to companies around the world, and as a result, the accelerated development and implementation of intrusion detection has become increasingly important.

Intrusion Detection (aka ID) is the practice of spotting threats to IT assets such as computers, databases, networks and devices. This article is intended as a basic primer for small business system administrators who are learning about intrusion detection, who does it and the technologies that exist to prevent it.

Why the Attacks or Misuse?

With hackers said to be attacking somewhere every 39 seconds, there are numerous reasons why your company's IT assets could be under siege right now.

  1. Financial gain
    If hackers can compromise your system, they could stand to gain financially by accessing electronic bank accounts, stealing customer credit card numbers, or just reselling your data. This type of hacker is most likely to be employed by a formal criminal organization.

  2. Industrial espionage
    Sometimes competitors just want access to company secrets, data, or customer information.

  3. Hacktivism
    Some people hack to draw attention to themselves and some because they have championed, be it political, technological, religious, or otherwise.

  4. Copycatting
    Some hackers do so to protest the arrest of other hackers.

  5. Resentment
    Disgruntled employees or ex-employees who have access may hack out of revenge for some incident they feel they have wrongly suffered at the hands of the company. These "hackers" sometimes conduct internal espionage as well.

  6. Bragging rights
    Some individuals still do it just for fun. This is the original type of hacker, and though relatively less numerous than in years past, this hacker still poses a very serious security threat.

  7. Security testing
    A security organization that wants to prove a point (or develop new business) might orchestrate an attack to show a company its vulnerabilities.

What You Need Protection From

No piece of software is perfect, and you can always count on hackers to attempt to exploit those vulnerabilities. Thankfully, most attacks on IT assets are simply variations on long-standing hacking methods, and as a consequence, it is a helpful to be familiar with some of the most common types of attacks:

  1. Buffer overflows
    By overloading a system and causing a buffer overflow, additional data packets can bypass a security measure such as intrusion detection and end up corrupting other data. Buffer overflows are often caused internally by programming errors but can also be caused externally by artificially increasing system and network traffic rates.

  2. CGI attacks
    These attacks exploit the flaws in CGI scripts written for a web server. The attacks typically involve exploiting standard install scripts and or scripts written by inexperienced web programmers.

  3. DoS/ DDoS
    DoS (Denial of Service) and DDoS (Distributed Denial of Service) are essentially the same thing: an orchestrated attempt to overload a network or service (such as a web server) to put it out of operation for a time, or to gain access for various reasons. DDoS uses distributed attack points instead of a single point. DoS attacks are sometimes performed as a SYN flood.

  4. Internal misuse
    Misuse includes database access or file tampering by employees or disgruntled ex-employees. This attack might also be motivated by competitors who pay the employee to conduct espionage.

  5. OS fingerprinting
    By being able to determine what type of operating system (OS) your network has, hackers can more easily determine your vulnerabilities. This is often done using TCP/IP stack fingerprinting.

  6. TCP/IP spoofing
    This typically amounts to forging IP addresses so they appear to be one or more trusted sites, servers or computers. This is sometimes done as part of SYN flooding (DoS/DDoS).

  7. SMB probes
    A Server Message Block (SMB) probe checks a system to determine what shared files are available. Used internally, probes can trigger intentional alerts. Used from the outside, sometimes in the form of a worm, a probe can determine file system weaknesses. Probes are also included in OS fingerprinting activity.

  8. Stealth port scans
    Stealth port scans check a system for commonly used ports (echo, ftp, ssh, telnet, domain, http) that may be vulnerable. It's used both as a security technique (using free tools such as Nmap) as well as a hacking technique.

When is Intrusion Detection Needed?

Now that you are aware of the individuals leading attacks, their motivations for doing so, and some of the most common methods for attacking IT assets, it is important to assess whether your specific company requires an intrusion detection system. The quickest way to determine if you need an IDS - Intrusion Detection System - is to go through a security needs checklist such as the following:

  1. Do you have data, which in the hands of the wrong people, could create a public relations nightmare for you, and or financial or privacy loss for customers and clients?
    1. Customer banking, credit card or other private information, some of which is to be protected under the Gramm-Leach-Bliley Act.
    2. Customer health records, which must be protected in compliance with HIPAA (Health Insurance Portability and Accountability Act).
    3. Recordings of employee calls, which might be kept for compliance with the Sarbanes-Oxley Act.
  2. Do you have data, which if stolen, could compromise your operations or credibility?

This is a very simplistic checklist, as there are other malicious activities which can occur as a result of attacks which may otherwise necessitate an ID system for prevention. Nonetheless, having gone through the above list, if you answered in the affirmative your company is likely in need of an intrusion detection system.

How Does Intrusion Detection Work?

Generally speaking, intrusion detection (ID) works by gathering system information and analyzing it for unusual or unexpected events. Historical data is later used for prevention, preemption, deterrence or deflection of network traffic and computer access.

To get a basic understanding of the specific steps that intrusion detection takes to better ensure security, here is a sample checklist of ID actions (some items are system-specific):

  1. Activity monitoring
    This is a wholesale monitoring of any user access and system events. Part of this task is to track user policy violations as well as to detect abnormal activity patterns and detectible attack patterns. A variety of analysis techniques designed for intrusion detection can be applied to determine if intrusions have been attempted.

  2. Configuration check
    Are your systems and networks configured correctly? Are there any detectable vulnerabilities in system configuration files? Are there any hosts listed in the network host file that shouldn't be? Each machine on a network should be checked periodically. Port scans are one task, another is to make sure configuration files are not world-accessible.

  3. General machine check
    Each machine on a network should be checked periodically for a variety of potential problems, as discussed in this list. If one machine on your network has been tampered with, all machines should be checked.

  4. File authorizations check
    Files should be checked to determine if user and group authorization settings have been tampered with. One way is to keep a map of expected file access settings outside of the systems being protected and compare it periodically with the current settings.

  5. Hidden files check
    Are there any unexpected/ hidden files anywhere? These could be viruses, keyloggers, password crackers, spyware, etc. Depending on the OS in use, files could be hidden by using a certain naming convention.

  6. Log file examination
    Server, process, router and other security logs can show intrusions through data mining of recorded events. Log files can show clustering of access from specific locations and/or frequency patterns. Keep in mind this type of ID is not in real-time.

  7. Packet sniffer check
    Are your systems running unauthorized network monitoring programs, aka packet sniffers? These might be recording user account data.

  8. Password files check
    Existence of unauthorized/ backdoor accounts can be found in a system's password file. (Just simply deleting an authorized account isn't enough, as there may be other compromised files. Change all system passwords at this point.)

  9. Scheduled processes
    Check for both unauthorized processes running as well as what appear to be authorized processes running unusual files. For example, if a keylogger has been installed and is recording passwords and user names, it will have to be uploaded at some point, usually at a specific time.

  10. Services check
    Are there any unauthorized services running? Most OS’s have service configuration files that can be checked fairly quickly for possible traces of intrusion.

  11. System binaries check
    Have any of your system binaries been altered? Files should be checked for both time/date stamp changes and checksums - though the latter isn't always enough if a hacker has emulated a checksum. System files should use stronger cryptographic checksum tools.

  12. System and file integrity assessment
    Anything else that hasn't been listed above that tests the integrity of your system and files is important as a catch-all for intrusion detection.

While many of the above intrusion detection functions can be performed manually, is is both easier and more secure to automate the checks through an intrusion detection system. Automated IDS’s are more powerful as they can perform the necessary file integrity checks and statistical analysis with relative ease. Analysis is a core necessity in intrusion detection, because it is often only through statistical anomolies that attacks are apparent. Examples of intrusion detection analysis include:

  1. Pattern-matching/ signature comparison of content to detect malware signatures.
  2. Behavioral analysis of traffic rates to predict possible DoS/ DDoS attacks or other anomalies.
  3. IP clustering analysis to determine geographic significance of attacks.
  4. Protocol analysis to examine network traffic in general.

Within the umbrella of automated IDS, there are two major types, Host-based, and Network-based. Host-based IDS’s monitor system calls, logs and network traffic, and protect only a single machine. Network-based IDS’s monitor network packets and rates and perform statistical analyses of traffic patterns.

Intrusion Detection Tools

Each intrusion detection system employs a range of tools to perform some or all of the functionality mentioned above. Here is a list of some IDS’s as well as some related tools. Be sure to check out IT Security’s white paper comparing some of the IDS's mentioned below.

  1. AIDE
  2. AirDefense - Guard Enterprise (wireless solution)
  3. Arbor Networks - Peakflow X
  4. Bro
  6. CounterStorm - Counterstorm-1
  7. Enterasys - Dragon 7
  8. GFI Network Security - GFI LANguard S.E.L.M
  9. ISS (Internet Security Systems) - Real Secure Network
  10. Juniper Networks
  11. Lancope - Stealthwatch
  12. Netpoke
  13. nmap
  14. Prelude-IDS
  15. SinFP
  16. Snort
  17. SonicWALL - Gateway Intrusion Prevention
  18. StillSecure - Strata Guard

Despite its wonders, an intrusion detection dystem is not on its own enough to protect your IT assets, as ID systems do not affirmatively remove intrusions, but simply identify them. As a consequence, IDS’s work best when coupled with an IPS (Intrusion Prevention System).

To learn more about intrusion detection, see Georgia Tech's Readings in Intrusion Detection, which, though slightly outdated, includes over 45 references for further reading. Finally, IT Security has an IDS glossary which will clarify unknown terminology related to intrusion detection.


Related Articles:

Intrusion Detection System Essentials

IDS/IPS Buyer's Checklist

Intrusion Detection Buyer's Guide

The Top 5 Internal Security Threats

Article Tools

Recent Articles