Welcome back to the last session of today, intrusion detection and prevention. So let's see what we've studied so far. We looked at the basics of cryptography. Then we looked at security protocols. We looked at software security, malware, network security, and now finally intrusion detection and prevention. So intrusion basics. And intrusion is the act of gaining unauthorized access to a system or resource so as to cause loss, harm, theft, etc. What are examples of intrusions? Unauthorized logins, installation of spyware into a victim's computer or infection of a machine with a worm or a virus. So these are different examples of intrusions. How do you deal with intrusions? Usually dealt with by a combination of preventive measures, detection followed by an appropriate response. But what distinguishes prevention from detection? So any examples here of prevention? Closing all the open ports. Yes. Closing all the open. All the open ports only leave some open at least? Some. I mean service which, apart from the service that you host. So which ones do you want to keep open? HTTP for example. 25. So just check what Google keeps open. So I think you all did the experiment. I think it was HTTP and FTP. We just did a scan on the Google server and they kept open at least these two ports. Were there more or just two? HTTPS and HTTP, not FTP also. So one thing is to prevent attacks, try to keep as few ports open as possible. Only the least things that you want, just keep those open and keep everything else closed. So that's an example of prevention. Any other examples of prevention? Firewalls. To prevent stuff, okay. So you prevent intrusions, you just write rules so that only these kinds of packets can enter, not some other packets, et cetera. So like that, it would be a nice thing to go through different examples that you could possibly list of prevention and detection and see which ones are this and which ones are that. And are there any other handling techniques that are neither prevention, not detection, but possibly things like recovery, preceded by forensics, et cetera. Prevention anticipates various kinds of attacks and takes steps to forestall their occurrence. Examples include the use of encryption to prevent eavesdropping. So I know that somebody is going to eavesdrop on this line so before that happens, I encrypt all my messages. And code auditing to minimize the chance of a buffer overflow or an SQL injection vulnerability, for example. So I thoroughly audit my code using some good tools so that any such occurrence can be eliminated. Intrusion detection system. So we talked a little bit about prevention. Now what about detection? First, an IDS. So the key things over here, the key verbs are monitors, analyzers, and alert. So somebody asks you, what is an IDS? What is it doing? Three things. Monitoring, analyzing, and then sounding an alarm or an alert. First an IDS monitors events of interest. Now of course, what is this event of interest? Occurring in the target system or in the network. An event of interest may be the opening of a file containing sensitive data. Now the only problem with this is you can start monitoring every single thing that goes on and then you have huge amounts of data. So that is not a very good idea because you'll have a lot of false alarms for example and stuff. So you have to be very careful about what are your events of interest. An IDS generates a large amount of data which it then analyzes and converts into valuable information. So from data to information. Valuable information to be used by system administrators. Now that's where you can use all your wonderful machine learning techniques and AI techniques and so on in trying to analyze this data and making sense of this data. Based on all this data, do I see that there might be a DOS attack or some attack etc. And IDS raises an alert each time it observes anomalous or suspicious behavior. The IDS should be capable of learning, so that's where the AI machine learning comes in the picture should be capable of learning what is normal behavior detecting anomalous events when they occur and flagging such events. So what is exactly meant by normal? Is this the normal number of logins per day? Is this the normal number of TCP packets that have come in etc. So I have to establish a baseline and whenever I find something goes very high or very low compared to that baseline then I take action. So the first thing is monitor. Monitor various system or network variables. Analyze the recent value behavior of variables. So analyze so that you can find the norm. Then any particular value or behavior matches an attack pattern. So does this match an attack pattern? What is exactly this attack pattern that you're trying to match with? There is a database of these patterns and you're doing some kind of signature matching. Any guesses? Matching what? Yes. So you said behavior of a virus. So you're trying to find for example if there's a virus that has been unleashed into your system. So the most basic thing is to search for a sequence of bits because as we said before most of these things actually contain assembly code. So you search for this pattern of bits and if there is a match then you conclude so this is what I mean over here the value of the behavior matches an attack pattern. So have you found this? Yes then raise the alarm or alert. And no, the other kind of intrusion detection there are two of these anomaly detection and signature detection. Is there an unusually high number of TCP packets coming in for example? An unusually high number of ARP response packets and so on and so forth. If so raise an alarm. So this is exactly what one of your IDSS would do. So for example to distinguish between prevention and detection in the context of passwords passwords should be strongly stored securely not written on sticker pads and should not be communicated to friends, relatives and co-workers. So this is prevention of password password abuse. Store it securely don't reveal it to anybody, don't let anybody see you type your password and so on and so forth. This will prevent password abuse. Now detection of password abuse an employee has for 10 years never logged in outside of office hours say between 9am and 5pm today however this user logs in at 4am. This should cause the IDSS to raise an alert. So this is detection. You find something very strange happening and then you try to take remedial action. So prevention prevention measure or preventive measure and a measure involving detection. Another example of the two we've just seen this in the morning buffer overflow. To prevent it make the stack non executable prevents at least one class of buffer overflow problem. This will be a one class. Is this will it prevent all buffer overflow problems making the stack non executable? Is there a buffer overflow problem which doesn't involve executing stuff that is written on the stack? There is and it's called the return into libc buffer overflow attack. Return into libc the libc is a c library. So what you do is you just have a call to the system library call and you pass the appropriate parameters. The parameters are on the stack but the code is not on the stack. You actually use the code of the system call and you can still launch a buffer overflow attack. So making the stack non executable to some extent prevents buffer overflow but not in every case. On the other hand detection. Again we had seen this morning an example of detecting buffer overflow using the canary. The so called stack smashing attack. Using the canary value on the stack detects a buffer overflow and thus helps thwart its possible exploitation. So here I'm detecting. I'm not preventing it but I'm detecting. I see that that canary value has been changed just before I exit from that sub routine and I conclude that there was a stack smashing attack. Okay some of the key questions what are the different types of IDSs? What are the variables that the IDS should monitor? When should an alert be raised? When should an alarm be sounded? Where should the IDS and the organization be placed? So some of these questions for example what variables should it monitor? Now when you think of designing an IDS or any system for that matter you ask yourself how well does it perform? So what do you think are the figures of merit for an IDS? Say I design an IDS how am I going to evaluate my design? When I design a microprocessor or I design a piece of software I look at functionality I look at reliability I look at security perhaps and so on. When I design an IDS and I'm trying to sell this IDS to the world what how is it going to be evaluated? How well it performs for example so what is the metric? Yes exactly so that's what I wanted the accuracy of the IDS so this is a key issue over here the accuracy of the IDS so the false negative rate and the false positive rate so what's the difference between the two? So the false negative rate is there is an attack and this guy never said anything about the attack the attack took place I was not warned and I've been harmed so if this happens this thing is a false negative and if there are too many false negatives we say that the false negative rate is very high so this is very bad the not so bad thing is false positives but it's very irritating to the system administrator to have too many false positives what are false positives? The attack is not taking place and every time I'm being told there's an attack there's an attack to the point where I'm just bored and I'm just endlessly interrupted from my work because I'm being told there's an attack but the attack doesn't take place this is called a false alarm or a false positive rate so the false positive rate and the false negative rates are two measures of the accuracy of the IDS and of course another measure is the speed as I mentioned before there was this code red scanning worm, internet scanning worm code red and the faster I'm warned about it the better as soon as you can warn me at least I can patch the machine or put the IS server off so the IAS I mean the IDS should have enough speed besides accuracy so here are some sample variables log-in frequency to a particular account I monitor this and I've got support to monitor this there are different kinds of logs in the system there are firewall logs operating system logs, application logs database logs etc so I observe the log-in frequency to a particular account and if it's unusually high I suspect there's an attempted break-in into the system this guy is trying to log in quite a few times he logs in too many times let's say 5 times and they're all unsuccessful attempts typically the system should stop him and it stops him but then again after 10 minutes he tries again and so on and so forth so then there's something suspicious because I see my operating system logs from the same account there are so many attempts to log in then the percentage of half open TCP connections half open means the SIN packet has reached and you've send the SIN plus act packet but you've not received the third packet so in many of these half open TCP connections I'm suspicious that it's possibly a DOS or a DDoS attack then TCP header flags I see all kinds of funny combinations of TCP header flags set I suspect that the attacker is trying to do operating system finger printing so anybody knows what this means how do I look at TCP flags and suspect that there's operating system finger printing Ritu Bala had mentioned when she was talking about the Nmap demo that you can also do besides figuring out the hosts besides figuring out which ports are open you can also figure out which operating system and which version is running so the trick is you send the TCP packet with some weird combination there are six flags in the TCP header like SIN, FIN, RESET etc you set some illegal combination of flags and send it to this system now TCP is implemented as part of the operating system different operating systems and possibly different versions will react in different ways so some might send you a RESET message some might send you a FIN message some might send you something else some might not respond at all etc etc so based on the response you can figure out this operating system did this this operating system did send a RESET packet with a RESET flag on this other one sent a packet with a FIN flag on this one didn't do anything and thereby you can conclude that it was probably this operating system on the host with this version so that's operating system finger printing where you send a lot of these TCP packets with different header flags on different combinations of these flags on TCP connection establishment to an unused destination port why is this guy looking at port you know 48 and port 79 and so on and so forth does he really want to do something port scanning so attempt to find which services are open then payload of the incoming packet I find a specific sequence of bytes in the packet and that tallies with what I've got in my database of signatures, worm signatures I suspect it's a specific worm attack then I look and see that there's a sequence of operating system calls that this foreign software has executed I suspect that this looks like the signature of a particular worm or a mutant of a particular worm, a certain worm family that worm family you know executes this operating system call followed by this one, followed by this one etc etc so that's another signature for worms not just a bunch of bits but also a bunch of operating system calls actually the new worm signature is a graph of operating system calls you have a full graph maybe of 200 nodes where there's a link connecting operating system call A to operating system call B if there's a dependency between the two that is A produces something say a handler that B uses so this is a new kind of signature for worms it's called behavior based malware detection there are two dimensions of differentiating these things, anomaly based versus signature based and network based versus host based so what's the difference between anomaly based and signature based anomaly based intrusion detection involves making a determination whether the behavior of the system is a statistically significant departure from normal so the first thing that's done and it's a difficult thing to do in general is to setup the IDS and train it to understand what is normal behavior so the IDS will have to learn over time what constitutes normal activity usage and behavior unfortunately the definition of what is normal may vary as a function of time of the day or day of the week what is normal for 10 o'clock at night may not be normal for 10 o'clock in the morning and so on what is normal may also vary from one host to another what is normal on Sunday may not be normal on Tuesday etc signature based IDS signature based intrusion detection works by identifying a specific pattern of events or behavior that pretend or accompany an attack such a pattern is called a signature so what is this worm signature for example a specific sequence of bytes but you can't really rely on that completely because of you can't just say that code read worm every instance will have this sequence of bytes because worms could be polymorphic and they could be metamorphic anti-virus product by creating polymorphic and metamorphic worms a signature based IDS maintains a database of known signatures it attempts to obtain a match between the currently observed behavior of the system and an entry in this database so what is the sequence of operating system calls does it match with some sequence that I've got stored in my database if so then it means it must be this particular virus a real world signature based IDS will have thousands of attack signatures against which to compare a network based IDS an IDS that captures information about packets flowing through the network is referred to as network based an example of the information captured number of half open TCP connections ratio of ARP request to ARP response packets the percentage of HTTP packets etc so what exactly to capture is you need a lot of intelligence use that information even more intelligence so the IDS is really something that is designed by experts a host based IDS typically implemented in software and resides on top of the host's operating system its main job is to monitor the internal behavior of the host such as the sequence of system calls the files accessed etc very much system variables rather than network variables it makes use of system logs and operating system audit trails to identify events related to an intrusion so we just talked about this an undetected intrusion is referred to as a false negative an IDS generates a false positive if it raises an alarm even though there is no intrusion currently occurring or about to occur so two aspects of IDS accuracy so some papers will talk about the sensitivity and the selectivity of an IDS as you can guess high sensitivity implies a low false false negative rate high sensitivity that's very sensitive it has detected all these intrusions so low false negative rate while high selectivity implies a low false positive rate I'm very selective about what I say I don't just say it's a false alarm and it's not actually an alarm so that's high selectivity one nice kind of IDS like device is a honeypot so honeypot is a closely monitored network decoy what is this word decoy a decoy is like a trap that you lay say for example you're trying to trap a tiger there's a tiger roaming around in this place in this land and you want to trap it so you put a decoy you put a goat or something tie the goat or a dog or whatever to a tree so the sound of the goat or the smell of the goat will attract the tiger in the night and then when you see the tiger you can immediately trap it so that's a decoy so the same thing you're doing with the honeypot a honeypot is a closely monitored network decoy you planted somewhere in your system it distracts the adversaries from more valuable machines on a network so the first thing is somebody is trying to attack your network hopefully it will see the honeypot that's why it's called honey actually because it's very sweet and so on they will be very attracted to the honeypot and they will try to attack the honeypot instead of attacking some of the sensitive machines on your network not only that so the honeypot is like a phony kind of thing so it attacks the honeypot and then you get all the viruses and other things that have attacked this and then you analyze those things analyze who sent this what was inside this etc etc which IP address did it come from so it distracts the adversary from more valuable machines on a network provides an early warning about new attacks and exploitation trends and allows in-depth examination of adversaries during and after exploitation of the honeypot so you deflect the attack deflected from sensitive machines to this honeypot and then of course you study what has happened to this honeypot who has come there and so on and so forth many new worms will first enter into the honeypot so you can immediately capture them and see what the whole payload looks like etc another person says it's a security resource whose value lies in being probed attacked or compromised so it's like the opposite you don't want something to be attacked but in the case of the honeypot your most eager that somebody attacks it so that you can find out more about the attacker now some measures to handle DDoS so there are different kinds of measures in different places it could be in the host, it could be in the network etc so packet discarding is one cache, syn cookies egress filtering distributed drought filtering various detection techniques and then finally handling it through IP trace pack so the first and very simple approach categorize the IP addresses that is the source IP address so you're receiving packets now which packet to allow and which packet to discard categorize the IP addresses is almost certainly genuine if it's almost certainly genuine you allow this guy to come in probably spoofed you be a little careful and so on and so forth so you just give them different grades the guy you really trust the guy you don't trust at all the guys who are halfway in between and so on under moderate load load conditions allow all incoming send requests to be entertained so when there's very little load find no problem everybody can come in even if they perform a DDoS it's not going to be very serious then when the load increases you have to be much more cautious under rapidly increasing load packets with unfamiliar source addresses are discarded with high probability the disadvantage is collateral damage is possible so can you think of an example where this might be might happen you have an e-commerce site for example and there's a very high load should I discard packets with all unfamiliar source IP addresses there's just an advertisement about my site on television so everybody wants to visit my site you've just heard that I've got a new product and everybody wants to buy it now many of these are first time buyers at my site should I discard them? no so what I'm doing is I'm actually hurting myself from the foot this is called collateral damage collateral damage is a military term used when your own soldiers by mistake fire on your own soldiers that's called collateral damage so unfortunately I'm hurting myself because potential customers to my site have been prevented from proceeding so you're discarding all the packets from new customers which is not a good thing at all so that is one approach another is handling DDoS via sin cookies how many of you have seen sin cookies what is the idea of a sin cookie so let's see it's a simple idea and it's implemented in many operating systems today the responding machine places a sin cookie in the sequence number field of the second handshake message the cookie is computed so it's not a constant number it's computed as a hash function of the source address destination address source port, destination port and a secret the initiator of the connection dispatches the cookie it just received in its act message upon receiving the act the responder recalculates the cookie and verifies that it matches the value enclosed in the received act only then does it reserve buffer space for the connection so you choose a random number for choose a random value for the sequence number in the second message of the TCP handshake and as you very well know the sequence number has a direct relationship with the acknowledgement number in the subsequent packet so you put that number random and you just see whether the guy sends it to you at a certain point of time the initiator if he does then he's a genuine guy otherwise the possibility is that it's a spoofed packet so this is a sin cookie and you can enable it only when you sense there is a lot of traffic and there is a DDoS, the onset of a DDoS attack is this clear or should I explain it again the idea for sin cookie so you choose a random number which is actually a pseudo-random function of the source address, destination address source port, destination port and some secret and you put that value inside the so that secret also will change over time and you put that value inside the sequence number field in the TCP header so the initiator sent a message the responder is responding that is the server is responding so you put that value inside the sequence number field and you wait for some time to get that value now what happens is the attacker will use the spoofed address he will not be able to see that cookie because it goes somewhere else altogether so you start on with the third message and then you time out and you just reclaim that memory space etc so this is the idea of a sin cookie as I said it is implemented on all modern operating systems the other simple idea is that of a sin cache while a connection is in the half open state minimal information about that connection is stored in a hash table called a sin cache so typically you would store something like 4 kilobytes or so for each connection request that is the buffer size but right now do not allocate so much space just leave only about 300 bytes not 4 kilobytes but right now because you have not completed the whole connection just leave about 40 bytes or so so you do not waste too much memory space the minimal information that you reserve includes the TCP sequence numbers the size is the sequence number sequence numbers and act numbers 32 bits so reserve 32 bits for that 32 bits for the act number source port how many bits for that 16 source port destination port IP address just reserve that minimal information which will take how many bytes maybe around 20 bytes or so 20-30 bytes that minimal information includes the TCP sequence numbers reserve only that much space for an incoming connection and only when you get the third message you reserve the entire 300 bytes so a full buffer of about 300 bytes for a given TCP connection request is allocated only upon completion of the 3-way handshake so this is the idea of a sin cache you just cache the connection parameters and then you allocate the full 300 when it is completed egress filtering another measure now so this is not at the host the other two things sin cache and sin cookies were at the host this is somewhere in the network your own network DDoS attack packets typically contains poofed IP addresses the egress router is the last router encountered by any packet generated inside an organization's network before it enters the internet if the source IP address of an outgoing packet does not match any address in the organization's network the egress router drops the packet by thus detecting and filtering poofed packets it helps prevent DDoS attacks so the idea is very simple over here so this is the network of your organization this is the egress router this is the last hop before it enters into the internet so this is the subnet and then this is the internet so what you do is every single incoming packet that you see everything that goes to the internet will go through this egress router you look at the source IP address of each of these things and if you see that it's an address that doesn't belong inside this domain then you discard that packet it's probably a spoof packet from somebody inside this network so that gets discarded because as I said before most of these DDoS attacks used spoofed IP addresses so this is one way of preventing any kind of spoofing of IP address so this IP address of an outgoing packet does not match any address in the organization's network inside the organization's network the egress router drops the packet by thus detecting and filtering spoofed packets it helps prevent DDoS attacks so these words are interesting detecting and preventing in the same sentence by thus detecting and filtering spoofed packets it helps prevent DDoS attacks interesting use of those two words in the same sentence you are detecting spoofed packets and thereby preventing DDoS attacks okay distributed route filtering this is another research idea that has come up I don't know whether it's actually implemented but somebody from I think it was Purdue University came up with this idea some years ago DRF is an extension of egress filtering to routers in the core of the internet so now notice where we have gone we started with handling strategies in the host then we went to your own network and now we are going to the core of the internet so DRF is an extension of egress filtering to routers in the core of the internet a DRF enabled router maintains for each of its interfaces the set of all source addresses from which packets arrive en route to some destination now as you very well know routing in IP looks at the destination address over here you are looking at the source address and you are seeing this is the source address therefore it must have it should have come from either this this or that if it doesn't come from there you discard it the filtering decision is straight forward if a packet with source IP address is equal to s arrives by interface it should not have that packet is assumed to be spoofed and is hence discarded let's try and understand what this thing means so probably a good example would be to take some cities everybody is familiar with this there is something in the center let's take Agra anything to the south of it Gwalior is that correct more or less okay we just take different directions New Delhi Jaipur to the west okay and I guess Kanpur would be southeast something here southeast Kota Kota so let's imagine this is a router and it's getting packets from different directions I was looking at the source port do you think it would be okay what would this guy's reaction be if he sees the source address being Mumbai and coming from the link from New Delhi something weird right what is going on over here Mumbai is somewhere there and how can you approach wherever you are going say you are going to Kanpur why would you be going from Mumbai over here in general this is not this doesn't make sense if you were coming from Mumbai you'd probably be coming from say this link or this link perhaps or maybe even this link but probably not from this link or this link so that's this idea of distributed route filtering it's an extension of egress filtering if the source address is Mumbai then you must have come from here most probably from Kota but if there was congestion on some link over there maybe you took a little detour and you came through Jaipur or you took a detour this side and you came through Gwalior but certainly not I don't suspect you came from Kanpur or you went through New Delhi and so on and so forth okay so I just look at the source and I discard it so what I say is if it is Mumbai it should be either this or this or this because most probably it's poofed so that's the general idea so the filtering decision is straight forward if a packet with source IP address is equal to s arrives by an interface that it should not have there's no reason for it to come from New Delhi that packet is assumed to be spoofed and is hence discarded okay so that much about some handling strategies now what about detection here's where you can use a lot of statistical stuff forecasting stuff and so on monitor the number of half open TCP connections a half open connection is one for which the first message of the TCP handshake has been received by the server the second message has been sent but the third message has not yet arrived so you monitor the number of half open connection if this number or this percentage of half open connections exceeds a certain threshold then you suspect that this is the onset of a DDoS attack so statistically you can come up with some very nice algorithms to do this just as a SIN packet is used to establish a TCP connection a FIN packet so another little algorithm everybody knows that when you establish a connection use a SIN packet when you terminate the connection use a SIN use a FIN packet I mean normal termination there are terminations with reset also but I'm talking about a normal termination so just as a SIN packet is used to establish a TCP connection a FIN packet is used to terminate it if in a given time interval so whatever the time interval you have to design that if in a given time interval the number of SIN packets greatly outweighs greatly outnumbers the number of FIN packets then a DDoS attack may be underway instead of looking only at the current interval so the interval may be too small look at the last few intervals to determine whether there has been a build up of SIN attack packets so how many intervals you look at what is the size of the interval what are the thresholds all of those things has to be very cleverly intelligently figured out then another aspect of handling this thing is from the law enforcement point of view is sort of like 4N6 is IP trace back so I'm trying to detect it I'm trying to prevent it first prevent then I'm trying to detect it I'm trying to handle it at different levels at the host within the network at the egress router at the routers in the core of the internet in a very rich area now what about IP trace back I want to know who is behind sending those spoofed packets or the guys that are behind it so the source IP address and DDoS attack packets are typically spoofed hence we cannot rely on their source IP addresses to determine the subnet from where they came instead we attempt to identify the path or the paths traversed by the attack packets this idea is known as IP trace back now there are two principle approaches to IP trace back either the packet keeps track of the routers it has visited this is term packet marking or each router keeps track of the packets passing through it this is termed as packet logging so can you just think of a way suppose you have to design a way for this packet marking how would you do it so the idea is you start at some point this is the place which is bombarding you and you receive these attack packets and you're trying to figure out where this thing came from what is the path so here is one suggestion in the literature can you somehow put a chap on the IP packet in the header of the IP packet in the IP header which might be a good place to write something so the average hop path the average hop count on the internet is about 10 hops now one thing I cannot do is I cannot take this packet that I started over here this is the source of the packet and this is the victim clearly I cannot put a 32 bit quantity by each of these guys my header is only typically what is the IP header typically how many bytes 5 bytes sorry 5 very good so 20 bytes typically and each IP address is 4 bytes so if I'm going to put 4 bytes of this guy's thing over here and so on this is going to be very very large but that's not a very good idea I would like to do that I would like each router to be designed such a way that it puts its chap on this thing so then if I get this packet finally and I look at whoever has put its chap on it I'll be seeing this guy's address this guy's address and so on but that's not very good because the header gets large and you're just wasting bandwidth can there be a smarter idea can you think of anything that can be done there are many many suggestions but let's look at the simplest basically what is the problem this is the attacker let's assume for the time being it's not even DDoS it's just DDoS he's attacking and he's got some spoofed IP address so this is the source of the attack and I'm the victim and here is my suggestion that I use this thing called packet marking so I mark something on these packets basically the identity of these guys my problem is I can't put 4 bytes of this guy 4 bytes of this guy all their addresses because this will get so large this is already 20 bytes and if the average hop count is 10 then I'm putting something like 40 4 times 10 or 4 times 9 I'm adding greatly to this header that's not a very good idea and I've got to change the entire IP protocol for that so is there some way the first thing is if I want to put some kind of chap the question is where to put it inside this header so it turns out that there is one field that is not used too much can you think of any field that is not used too much in the IP header I think it's a 16 bit field in the context of fragmentation there is this ID field which identifies you see if you fragment the IP packet then all those fragments will bear the same ID number so that at the receiver and you can put them together now that is not used too much because these days there is less need for fragmentation so very often that ID field is left blank or unused and that's a 16 bit field but now I've got another problem ID field and how do I accommodate all these IP addresses I can't even accommodate one of them so anybody has a solution to that think about the good old hash the hash function suppose I've got a hash of the IP address and I've taken an 8 bit hash for example hopefully it doesn't collide too much 8 bit hash maybe I can put two of these addresses and that's exactly what they do they put only some of the addresses so for instance I can put a 16 bit hash or I can put two 8 bit hashes in that ID field so suppose I put one of those one 16 bit hash in the ID field then I probabilistically put my chart on that field so with probability p I put it and with probability 1 minus p I don't so as it's going along I may put it I may not put it this guy may put it this guy may not put it and so on and so forth so it's entirely possible this attack packet has gone over here and it's this router and this guy has put overwritten on that chart so I see this guy's name on it then it might be the case that in the next packet it may be this guy put a chart and this guy put a chart but nobody else so ultimately if I collect enough attack packets I will get a good idea of the path from where this is coming of course assuming the path is fixed and it doesn't keep varying all the time so that's this idea of packet marking so the packet keeps track of the routers it is visiting and this is called packet marking the other approach which is the opposite is each router keeps track of the packets passing through it this is term packet logging again this looks very fantastic how can you look you're seeing you know gigabit links you're seeing so many many many packets per second how can I keep track what sort of data structure should I design so that I keep track of every single packet that has come to me again there are some very nice solutions to this so first packet marking what I just said the IP header has no provision for keeping track of the routers it has encountered however a 16 bit ID field in the header is employed over here a router's IP address is 32 bits hence the IP address is not used to identify a router instead a global fingerprint of a router is used this is a 16 bit hash of the router's IP address to complete the story probabilistic packet marking an intermediate router writes its fingerprint the 16 bit hash value into the ID field of a packet's IP header with probability p now p is again a design parameter note that it could overwrite a previously written fingerprint of a router closer to the source of the attack each ingress router has a map of all the upstream routers from it to identify the perpetrator of the attack the ingress router at the victim end will need to collect a sufficient number of attack packets that are part of the same flooding attack based on the value of the ID field in the collected packets the victim can construct the most probable attack path so this is one way in which law enforcement can figure out who is the perpetrator of this attack where is all this emanating from the other approach is called packet logging with packet logging each router attempts to keep track of every packet that passes through it in say the last 5 minutes so I cannot keep track of too much but at least let's see if I can keep track of the packets that have come into me during the last 5 minutes span the average size of an IP datagram is 500 bytes so the amount of space required in each router is absolutely ridiculous it is 1 terabyte so who is going to spend that much money to put 1 terabyte on each router the space requirement can be greatly brought down the details are in the textbook can be greatly brought down by the use of something called a nice interesting data structure called a bloom filter so you can bring it down drastically from a space of 500 bytes per datagram to just something very close to about 10 to 12 bits per packet you only need that amount of storage per packet that is coming in and again I am only storing packets that have come into me the router in the last 5 minutes so then what happens is when I have stored that information here I am the victim I ask everybody have you seen this particular packet all those who are connected to me have you seen this packet so of course I know where it has come from so the correct guy will say yes it has come from me then he will interrogate the guys further upstream have you seen this packet have you seen this packet etc so that is actually the hash they compute a hash of the content and so on have you seen this so one of them will say yes I have seen this thing with this particular hash value the hash value of the packet content then he will interrogate the guys further upstream have you seen this hash value etc so one guy will say yes and so on and so forth and finally they will be able to trace back this is the source of the attack so this is through packet logging rather than probabilistic packet marking so these are two approaches that have been greatly studied in literature and also you've got hybrid approaches which are a combination of the two we've talked a lot about DOS and DDoS but what about the challenges in worm detection so one of the big things is I've got a database of worm signatures but what happens if there is a zero day or zero hour worm everybody knows what is a zero day worm I've never seen this thing before if I've never seen it before it's been unleashed just yesterday my antivirus product doesn't have this in its signature database now what do I do, how can I detect this thing so that is one challenge how does one detect a new worm that has never been seen before a database of worm signatures will almost certainly not contain the signature of the newly unleashed worm so this is a serious problem because new versions are being created all the time the next thing is speed efforts by humans to detect internet scanning worms could take hours as we had seen before this is clearly unacceptable worms such as slammer which spread across much of the internet in just 15 minutes and then the other thing that I mentioned and that is non-monomorphic worms polymorphic or metamorphic worms detecting such worms is not straightforward since multiple instances of the same worm may not contain the same substring so what you do in these worms as I mentioned is that the payload is encrypted so when I'm seeing this thing going through the internet all these routers and all are seeing it they see different bits different sequences of bits in different instances of the same worm so what is the solution so one solution, this is again one of the modern things that is being done is what's called behavioral based malware detection dynamic behavioral based malware detection what it does is it captures that entity you suspect something that's coming to your organization as a worm I don't know it's all polymorphic and so on it's a secluded, isolated environment because I don't want it to create trouble so in a sandbox and then I execute the thing and when it's executing guess what I look for its behavior what does behavior mean how do I capture behavior basically the worm has to make operating system calls it has got to for example write into another file if it's a virus write itself into another file when it wants to spread or set up a TCP connection to infect somebody else and so on and so forth so I monitor the system calls and from the sequence of system calls it's not even the system sequence but it's a graph of system calls from the graph of system calls I'm able to deduce which species it belongs to so there might be a total of 10,000 different worms but many of them are mutants of the same worm for example there might be 100 mutants of the same worm so that's how I figure out all those mutants will have the same operating system graph this graph is a graph of dependencies that is A has to take place before B takes place and so on and so forth so there might be only there might be say 1000 mutants for each species so my signature my database of signatures will have only for example 100 entries each entry will correspond to 1000 variants so this is the idea and I can very easily see now based on its behavior some other one so that's basically the solving on IDS and IPS


Virgo, welcome back welcome back to your your love reading Welcome back to my channel. This is Kelly from house of Virgo.  How's everybody doing? I hope you are super super awesome everybody. All right If you want to get a personal reading for me, click the link in the description box below Please do hit like share subscribe and tick the notification bell so you will get alerts All right you guys remember it's a general reading be mindful some of the messages may or may not resonate if You're new Please be aware of my messages at times can be candid otherworldly and completely off the cuff so Take it as it fits. All right Virgo. Let's get a look here and see what your love messages are Virgo sun moon rising our Venus Virgo sun moon.  Are you hiding? Are you saying?  Nobody bother me Virgo, all right Do we have any spirits here today? I don't know if you guys listen the reading yesterday The one right before this you could hear someone's voice Strange voice. It said it was a female voice. It's a hello. Hello Very strange go back and listen to it. I have no idea if somebody can find the timestamp timestamp it Time stamp it. I'll pin it. But yeah, that was so weird. Okay. We're just gonna get started look Here you are coming out in your reading Virgo What's going on with you? Okay Virgot Taurus Capricorn six of pentacles Aquarius the fool the four of wands center of the reading night of pentacles the eight of swords Ace of wands the tower And the queen of swords cat fight Cat fight They just told me oh my gosh Bottom of the deck five of wands.  Okay, you are the superstar You are the superstar of the show and somebody is I don't know. Okay. Wait. No, no Now they're saying there's another person male or female Who's looking at you and is Trying to stir up some trouble. This is a weak-minded individual Okay, they're they're a restless type of a person. They may have been involved or connected to Your person Okay, I See a marriage here But I feel like there's jealousy Somebody's trying to cause a tower moment in your life There's there's a female or a male.   I just feel like you're going into hiding You don't want any drama. You don't want to deal with this or you're not Really making yourself seen and there's a there's a rival who's watching you You've got somebody who you may be connected with or in a relationship with or This could just be Another like a person at your work this could be your ex's current partner or something's going on here Oh my gosh Okay, we have Aquarius we have Taurus Virgo Capricorn Scorpio Libra Gemini, okay, just gonna throw that out there and now we have Pisces Hold on a second for some of you there the person that you were connected with before is stirring up trouble with the one that they're with and they are That they're fighting there's like arguing going on between them because of you because you shine so bright wherever you are Okay, and I feel here. All right, what are they telling me? I mean wow this so your person is trying to break up with their purse the person that they're with or whatever by Talking about how awesome you are how amazing you are how well you're doing But they're not like they're it's underhanded it's kind of like some underhanded drama that this person is saying To your person. I feel like there's somebody here is really Like envious and jealous of your glow up. You're free.  You're being charitable.  They're looking at you and They're like what happened to Virgo Virgo. What did Virgo do?  I don't know if you're hiding from this person or you're just staying out of the way with somebody I Just was looking at this card here.  You're doing you That's what's going on.   You're doing your own thing.  You're just set in sale Go in to make your money live in your life doing your best thing and the people who you left behind are all back on the shore Pickering with each other about you or fighting about you are fighting over you I love how the music changed right when I said that if you can't hear it You should put your headphones on because then you can hear it. All right, let's get the love messages here What's going on with this person?  This the romance of a lifetime. Oh finances and career I feel like it always shows up right here All right, we're gonna go in we're gonna do a deep dive here So what's going on with this person?  You're paying your bills your You're helping people out maybe financially in some way I see you taking care of business. They're seeing you taking care of business.    You're shooting star right here And that's what they're looking at. That's what they're seeing about you right now and there's people whoever they were with like I was saying is jealous of you and Envious All right, let's take a look. What else are they seeing? Wow?  That's a card of commerce Maybe you're traveling or you're working with teams or you've got a team or you're working with others This person I just feel like they're looking at you and you're not even paying attention To everybody you left on the shore there They're all back there. I feel like they're still fighting. They're still arguing. They're fighting over you You're just like yeah, not my problem You know you deserve love and you're going at it going after it and I feel like this person sees that as well They know you deserve it. There's something you did Virgo. What did you do? In six pentacles. Yeah You made a decision They see that you're blocking them. Some of you have blocked this person Or some of you are just not engaging or responding When they're messaging you or they're trying to get a hold of you You have freed yourself and they see this and they know this and they Honestly, they don't like it. They're finding fault now with the person that they that you left them with They're finding fault now with the purse they're comparing and they're seeing that the person that you left them with is Like that doesn't even compare to you Does not compare to you Virgo They're actually like they're totally wild.  Yep nine of pentacles here sitting on the full card.   I Feel like you're all right. We're gonna take a look at this other person here Okay, there's other male or female Because I feel like this other person that they were with or it might still be with It's just really cold rigid.  They're not nice They might be like have some kind of drug or alcohol addictions or something I just heard like your person feels That they made a mistake letting you go Or choosing another somebody else that they got like sucked into through a physical thing Definitely All right, let's take a look get the four of wands here, so Yeah, there's some this person. I feel like it's they want to come back or come home reunite This is reunions. Let's take a look here. I mean you can't make this up six of cups Yep. Oh, they're coming back in.  All right, let's see, but they're coming in listen burgo You mean being able to pick up my cards. Oh, they're coming in to invest. They're coming in to purchase. Oh Yeah, they're coming in trade a little bit here Look at that. That's sneaky M ever with the seven of swords this person coming in They're gonna sneak back in. Oh, yeah, they're gonna try to steal this true love thing back with you.  It might be a gift or a token this person's coming in with Oh, man, there's like a cat fight. I feel there's a cat fight for some of you I feel like whoever they were connecting with you're gonna be like hearing from that person See, it's funny.  You're in this like you're glowing up even more This person you're connecting with my goodness, but they're coming back in here. Oh, yeah They get the aid of swords here. They're really They're feeling really trapped in their situation right here I'm feeling really trapped they feel imprisoned They want to be free they want to be doing what you're doing Virgo They like what they see What you're doing and that look this person's given them so much how They just feel completely trapped mentally trapped You're their true love you are their true love and they made a mistake big mistake here So the four of swords came out here in reverse this person is restless. They're trying to break out I'm feeling like break out. That's the words the phrase they're giving me this person's trying to break out of prison Okay, and they're not staying with that person that they were with They're restless they have a lot of anxiety. They're completely burned out and They're breaking out. They're coming back your way. They're gonna sneak back in. They're gonna try Let's say right. I want to see what's going on with this person. They were with The emperor showed up in the reverse narcissistic biatch or whoever male or female Very manipulative this person that they were connected with they got totally fooled Immature a power play this person like controlled with power nasty ego Really bad planner this person that they were connecting with Just couldn't hold on to their money they were just all over the map an addict or Alcohol or drug or sex addict, you know this person was using them Whoever they were with was using them abusing them. Oh boy, this feels like a karmic a karmic Lesson learned here. Hopefully but they're running listen Virgo. This person is running back to you They're gonna be running back to you Okay, so All right, they're giving me dates Okay, so to two year dates here. I have Nate or no, I've got 1960 1948 1984 Okay And I have April 8th August 4th August 1st August 6th somebody's two guys might be dealing with a Leo I'm also seeing Some of you have birthdays on the 1st 4th the 6th and the 8th. Okay, some of you also the 18th the 14th the 16th Okay, all right, let's take a look here This you all right. So some of you your person met the person they were with Through work. There was like a work connection man. This whole thing fell apart This whole thing is just completely fell to pieces ruins And your person was starting fires with them Starting arguments and stuff like that to get away to break away from them They want to run back to you running back to you. Oh I want to run away Running away from the situation and what they were in Seven of pentacles in the reverse This person's giving up. There's no reward here with who they were with who they were connecting with No reward.   What's going on? What you're putting out into the universe?  That's what I feel they got a mirror of themselves And you know what you guys you got to know something. I just noticed The only major icon in here to clarify is the emperor in the reverse And your person met there.  It's what I feel like it's going on here with you Like you some of you have just completely freed yourselves and got out Which is so awesome and they're looking at you like they're jaws dropping Because you're shining bright here because you have the star card.  You're glowing.   I don't know you're like some of you are just totally like I didn't do anything but because The person that they got with is so awful and sorry for my music slot But the person they got with is so awful.   Knew it was coming along. I Hope that music's not too loud. It's like really in my ear. I'll try to lower it when I like Edit the video. All right, let's see what your messages are here. What else is going on? What is going on? Okay spying and deception This person is watching you like a hawk.   You did everything for them.  Okay They're not only re-evaluating their career this person if they met them at work this person Or connected to a career or work situation They're like re-evaluating that whole thing. It's not even just not communicating with them It's like changing the job or getting out of that industry and getting away from this person because I feel like the person that they met is Is just as or if not worse Than your person Stalking them obsessive possessive behavior Like completely out of control causing chaos with the tower well Causing chaos in their life there and especially if your person is trying to leave them This karmic is gonna try to destroy their even their career Oh That's strange.  Um, I I don't See Communication so to speak happening Because I feel like a lot of you have blocked this person and a lot of you know who they're connected to so you've blocked them too So I feel somehow they're watching you, but they can't reach out to you.  It's like it's it's getting ready. It's coming the drama is just beginning like there's fights that that's happening between You you're a person and the one that they hooked up with or went with Things are going things are going downhill fast Let's see what else Okay, I Don't know why my cars are showing up in reverse. They're in the upright the struggle is over in the reverse No, it's not. Oh, it's just starting. It's just starting So I know some of you You had this person who? Left you for somebody else and maybe made it seem like the one that they left you for was better Well, Carmen's coming now Okay, a lot of you were sitting there questioning yourself doubting yourselves You know what happened? Why did they choose somebody else all that energy? Guess what?  I never thought it would happen Oh, yeah, it's coming There's gonna be a cat fight might not be with you and this person It might be with your person and the one that they were that they left you for they were connecting with This person that they're connecting with is gonna Exact revenge on them in ways that you never could even bring yourself to they're gonna expose them and All the things that they've done somehow some way Because I'm seeing flashes of images.  That's what you get.   They get what they deserve That's not my problem Because you're just doing I just see you you're gonna be doing so well going forward You've just a lot of you have just blocked and deleted and you just were completely Did like cold turkey cut off and your life is just improving Let's say Okay, it's buying online now. That's twice. All right, this person is I'm telling you they're both watching you They your person and their karmic are both watching you right now You might not be online, but they are searching for you. Okay? And if you are online, they're watching you on there even or they're certain it feels like mostly searching to see You might still be on some of you might be So might not be on social media.  They want to find out like a background check They're digging for info And your person's trying to get away and run back to you and I just feel like you're already gone.   There's just drama. There's scandal My god Okay, that's a strange message Take charge of your divine masculine energy. There may be a father figure who's guiding you strive for respect dignity and power an Influential male may be supporting you in some kind of change here Committed love relationship. Okay. What's up with that? Let's see.  That's what I feel like is going on here I mean, I don't even feel like any of you we want to hear about this I feel like some of you are just like, okay fine It is what it is This person's gonna come back and try to commit But I feel like a lot of you are just like after after all this happened and now more No, you're trying to get out of and away from this And especially if they if their person's coming in after you or searching it. There's just Trust me Virgo. You are looking amazing in this reading like you are So people are looking at you.   You got this healing thing going on You're just doing well, and I feel like there's jealousy Envy happening here. We're gonna go into the singles We're going into the singles. I just feel like you know, if some of you I told you like I said this before The best revenge is dish Revenge is best served cold That's what I'm trying to say and I just feel like a lot of you went cold on somebody here And you just allowed spirit higher power to take control of the situation and just do its work do its magic Whatever and that's exactly what is happening here karma karmic karmic is giving to your person and they are gonna come back.  I made a mistake. You know what? Let's go into the singles.  Okay, they need a lot of bleach But they can get cleaned up. There's some group of you here who are listening.   It's there. They're in a twin flame thing. They want things to be better Can things be better?  All right, let's see singles All right, so you're definitely going to be getting some communication coming in Now this is not your past person because I already said they're definitely coming in Worth asking for new and spirits telling you there's some type of communication some of you're gonna meet someone through your kids Another parent maybe okay. It doesn't matter how old your kids are. Let's take a look here Look at that Wow The stars back again. Oh My gosh This person's in the same energy as you are okay. It's an Aquarius. It's a new Aquarius a very well healed healthy hopeful a Very Beautiful type of energy this person is like a miracle coming in for you This might be somebody who's in the spotlight or connected to something Maybe that you do like you guys have some healing. Maybe you work in hospitals or be like healers or something In the metal maybe there's something connected to the medical community or work with children There's definitely Communication coming in an offer for a date. Look at all this healing energy here Okay This is also karma, but this is your good karma coming in okay, this is positive karma coming in This is you finally getting what you deserve finally meeting the person who is Right for you finally connecting with someone who's good for you Okay, which is beautiful and they are in the same like field or line of work Or they have the same slot process So we have Aquarius. We also have Scorpio energy. They're in the same energy as you right?  There's gonna be like a Revelation with this person Where you guys talk and it's like oh my gosh, I cannot even believe it like I finally found the person for me It's like a wake-up call kind of thing here look at this Eight of wands a lot of communication coming in with this person keep its arrows so I feel like This person they just told me might be like a news reporter or a journalist For some okay, they travel and they report news. I mean some of you could just be like Just giving the image of like the the guy who drives around in the car and flips the newspapers out the window It could be that guy for that girl Hey, you never know love love comes in all shapes sizes and forms, right? So I feel like um They might travel maybe they're a pilot, okay Let's see. Oh all right, so This person has gotten has been in an abusive relationship before They've had you two are gonna have so much in common to talk about it's not even funny There's just gonna be this higher level healing understanding between the two of you. Okay. Wow six of wands Okay, but now we have cancer energy and Pisces Okay Yeah, this person I feel like you may meet them when they're in Your area. I was just saying like somebody's driving around flipping mail or packages or Newspapers out their car window Just strange message. Why is that like Coming up like that. I don't think it hit you in the head with a newspaper or something.  So I just kind of feel like I Don't know. I just see it in my mind. I mean you got to come back and tell me like if you found love out on the sidewalk He got knocked over by like I don't know package or something could be your UPS driver or Amazon It doesn't matter what people do for work, okay, as long as they're working, right?  Oh, they just gave me like parking valet Okay, hold on a minute. Oh Okay Hmm. This is strange. This is a very strange message bear with me Because I get these messages this person for some of you they might also be now. I'm giving you different scenarios We have a lot of different people so It's not like you all are gonna meet this one particular person I'm giving you different scenarios So some people might be getting hit in the head with a newspaper for others this person. This is gonna sound crazy You'll see them on a float on a parade and a parade a Float and on a parade Or you'll work with them on like a parade committee or something for the holidays like on a float So it's so weird So weird. Okay, wait, I'm just gonna get one more and I'm gonna leave. Oh, no, they said Some of you may have met know this person you might have met them in 2017 or 20 20 okay, or 2018 Okay, this person is that their birth is coming up as 1968 or 1985 Or 86. Okay, just for like age-wise and I'm not sure offhand what their Chinese sign would be So Alright, I'm just gonna leave that there. So it feels like around the holiday. So like in the next three months That's what I feel like Let me just okay. They said just get one more card Okay That's crazy.  I just heard ticket holder. I don't know what that means ticket holder Is it a Halloween parade maybe Somebody celebrates Halloween it could be like a Halloween parade or something Okay, that's so strange Okay, I'm gonna leave that there. I'm just gonna leave that message there But definitely the first reading I feel like there was a cat fight or there's something there's like claws are out Something's gonna happen. Something's coming up.  And you may get you know what I got to ask. Sorry is this is there gonna be communication coming to Virgo? because I know a lot of you have this person blocked and You know, you're not gonna be able to get anything But I just have to ask if they're gonna try there's gonna be communication towards Virgo from, you know, the karmic or the I don't I feel like your your person from before is gonna Like either show up at your door or they're gonna send you a gift or flowers or reach out to you through like mail or something You know, like it'll be something tangible that you'll receive All right, let me say King of Pentacles reversed All right No, I don't feel like the I don't feel like the karmic is gonna be reaching out to you But I am gonna tell you like I said before they are because they don't have they don't know how to get a hold of you They are gonna try though at some point later, but right now they're searching for you It's gonna be like a fight like a cat fight or something. We're just gonna get a couple Okay Yeah, beautiful and imagine Okay And then you've got the tree. Oh The tree that this is like I don't it's a tree of life and you've got a key and a and a fishbone Okay, that's weird. Did if you've lost a key They're saying it's oh, it's by the tree or the bush. Okay. I just heard that but this key this feels to me like Oh They're just telling me to tell you to go get a spare key. I don't know why go get a spare key made You may be getting that you may be doing that or you may need to do that right now Okay, and there's something here about this tree. Is there like a Is there like a grave site of someone that has passed away?  I just feel like They want you to Go visit them. They might have been a Pisces for some There's a message there for you to go visit that person Like there I'm hearing them them saying come see me come see me you are so beautiful and I think about you all the time. I just heard that. I Don't know if that's you saying that or the person saying that Yeah, and that's what I kind of feel like this fishbone is connected to like a skeletal remains of some sort I know this is morbid But That's really the strongest message here. I'm picking up with that. Let me just get one more Because you are beautiful Alright, you have an acorn This feels like the fall. Alright, that that's really just what they're telling me here This is like a channel message from someone that has passed away This could be an ancestor or it might be something you don't know about somebody who is buried I'm just hearing maybe acorn cemetery or someone who has passed away or they are buried You have to go see them Okay And I know this isn't going to be for everybody But for some you have to go to that grave site. It's somewhere by like there's a beautiful tree there It may not be I guess they would not put Burials graves right by trees, I don't know but there's a very but there is when you go there There's a beautiful beautiful tree that you will see like it's like the biggest one there And it's just gorgeous and you're I just feel like I'm channeling a message. You need to go there. You need to visit Or you need to just make your mark there your presence there. There's a key there There's some information there something that's going to unlock something for you That you unlock your imagination bring out your beauty or your your Something going on within you that's trapped and locked in this person Whoever has laid for us there is saying for you to go there. I Don't know. I don't know what's going on there. I don't know what that's all about I'm just gonna get three cards from the messages of love oracle for you before we finish Doing things a little backwards here today, but that's all right I just go with the flow whatever calls to me Okay fate. This is a destined partnership. Okay That's for the singles with this somebody new coming in because that was the star card. That was a faded. That's a destiny Okay friendship. Yep, you guys will be friends and things will be moving forward It will lead to more like you and this person however you meet Don't judge it. Don't judge a book by its cover. Don't look at this person and say, okay Well, their career is they're flipping newspapers out the window. Don't judge Let spirit Infiltrate Okay, because this is going to be your person. You never know this person could just do this on the side and be a billionaire I just doesn't want anyone to know right. You just don't know don't judge. Okay release Radical acceptance and surrender can help you let go. I feel like fate friendship and release I feel like what's going on here? You're going to meet somebody new and they're not going to be what you expect Okay, you may let the obstacles keep you from seeing more Don't let the obstacles keep you from seeing more into this person of how they might be Okay, what they might act like how they will treat you because I feel like this is a destined Relationship starts as a friendship and needs to more help you to release and let go of a lot of your burdens There's just like a it's just like a powerful like Exhale when you connect with this person And then you have this ability through them what's that story I just heard with machine gun Kelly and that Kardashian girl he would never get back on a plane again until he met her and She helped him Get on a plane again. I guess he was in some plane crash or something. It's because of her She inspired him and helped him do things that it just brought his hope back renewed his spirit And that's what I feel like is going to come with this person for you It could be like an angel in disguise, but it's destined so I mean leave your reading there Stay hopeful stay out stay optimistic, and I will see you guys tomorrow. All right. Take care. Bye


A fiery horse with a speed of light, the cloud of dust and a hearty high old silver, the Lone Ranger. With his faithful Indian companion, Tonto, the masked writer of the planes led the fight for law and order in the early west in the United States. The stories of his strength and courage, his daring and resourcefulness have come down to us through the generations. And nowhere in the pages of history can one find a greater champion of justice. Return with us now to those thrilling days of yesteryear. From out of the past come the thundering hoofbeats of a great horse, Silver. The Lone Ranger rides again. The Lone Ranger riding between two mining towns in the Black Hills saw a square of cardboard fastened to a tree. He hurried toward it with Tonto close behind. Look at that, Tonto. Ah, that reward notice. We saw another one of those at the edge of that last town. And there's a $10,000 reward for the capture of that man dead or alive. Um, that's not good. May describe me, masked man, light hat, white horse called Silver. The reward is offered with a Drexel syndicate. Drexel know what you do. No doubt of that. You must have heard how we were trying to interfere with his operation in this part of the country. Maybe you make too much trouble for Drexel. Not as much as I'd like to. Perhaps these notices are a good sign, Tonto. Drexel wouldn't be willing to spend $10,000 unless we were in his way. That's right. But plenty people know Lone Ranger and plenty people good friends. Drexel has thought of that. The small type here at the bottom of the notice he explained that the real Lone Ranger's in Texas. He says that I'm really a crook posing as a Lone Ranger. But you've got ring on finger. Only real Lone Ranger wear that. Anyone gets a chance to shoot. They won't stop to look at a ring. Uh, maybe you hide for time, huh? Hide? That's what Drexel would like. Well, we won't hide. We'll keep after his agents who are trying to buy up all the gold mines. But wait, Kimusabi. Well?  Plenty men maybe want to sell gold mine. Get cash. Drexel isn't fair, Tonto. He doesn't pay a tenth of the amount the mines are worth. Furthermore, it would be a bad thing for one firm to control the industry. Man? Yes. Merrick is founded on free enterprise. All gold mines are operated by one man. The mines would have to take whatever pay was offered. There'd be no competition. Drexel would be able to name his own terms for every piece of machinery he bought. Every railroad he used. Every man who worked for him. Uh-huh. That's right. Yes, he'd be too powerful. Not American to give one man too much power. He'd make slaves of the people he hired. And Tonto, there shall be no more slavery. Uh-huh.  Not tonight. We'll find a place to make camp and go into town in the morning. The horses need rest, and it'll soon be dark. Yep, it gets dark early at this time of the year, Potter. Surprised to see you right up, Beasley. I thought your evening time was spent in Pharaoh's gambling place. Business, Potter. That's what brought me here. I don't see why. I told you last time I didn't want to sell a Nancy Jane. But I keep my gold mine and work it. You're using poor judgment, Potter. The Drexel syndicate is getting pretty powerful in this part of the country. Isn't that powerful enough to tell me what I'll do? And I might add that Mr. Drexel has indicated his displeasure at the salaries you pay your men. Oh, he don't like it, eh? He'd sooner I'd starve than like he does. Well, I won't. And there's another thing, Potter. You might find it difficult to get railroad facilities to ship your ore. Why should I? Well, Mr. Drexel is in a position to contract for all the facilities that are available. Now it wouldn't be easy for you to ship gold without railroads, would it? Easily, I won't sell, and that's that.  No, no, wait, Potter. There's another thing. Well? Suppose you had a cave in and needed a lot of heavy machinery to reopen your mine. I suppose I'd have trouble getting that machinery. That might be the case. Well, I won't have a cave in. My shafts and tunnels are built right. I don't risk the lives of my men like Drexel does. You never can tell, Potter. What if someone had a grudge against you? There's a lot of blasting powder around here and a lot of men who know how to use it. That's enough, Beasley. I've heard about enough of your threats and hints and suggestions. You'll find the men out here don't scare easy. Now get... Very well, Potter. If you change your mind, let me know. We buy gold properly in any condition. Even cave-in mine. I said get. You can reach me at Pharaoh's gems. Get up there. Hey there, Silver-Oil fella. I'll have the saddle off in a minute and a rub down for you. Oh, look. Jonder, Kimusabi. Me see light in next town. I see, Tonno. That means there's any fire we might build would serve as a beacon. We'll do without a hot meal tonight. I often... Look. Look there. You see? Red flare in the sky. Tonno, is that a signal? Wait a little. You hear it? That blast. An explosion in a big one. An explosion like that means trouble. Trouble in the black hills generally means Drexel. On up, Tonno, we're riding tonight. Steady scouts. A case inch tight. It'd be an easy tale to leave hills at night. Hey there, Silver-Study boy. Hey fella, ready, Tonno? Me ready.  Come on, Silver. There's the mine. The whole mouth is caved in. Easily warned the gun that's scheming crook. Hey, father, look there. There's 10,000 reward for that man. Stand back. Me for that reward. Tonno, break for it. Right.  Come on, Silver. You got it, Tonno? No. Tell him to shoot to pass. But go wild. Good.  Too much to be done. We've got to be free to move. And what we do? Way enough. Easy, boy. Easy. That's it. Tonno, I've got to go back to that town. I've got to use it this guy. Here, help me unroll my pack and get out the old clothes. Tonno, fix it. You've not only got to fight men who blow up gold mines, but we've got to show these people that the real loan rangers in the Black Hills are not in Texas. Vern Gardner was one of a few mine owners who would have welcomed a chance to sell out. He was tired, discouraged, and broke. Both Vern and his wife, Sarah, showed signs of hunger as they sat on the veranda of their house and creaking rocking chairs. I'm sorry for potty. I reckon he'll be as hard up as we are now. After the explosion last night, I don't suppose he'll be able to give you the job he promised. He won't. I asked. This is the end, then, Vern. I don't know what's to come of us now. Look. There's another newcomer heading here. The poor critter, I suppose, he figures to make a strike in a fortune. He's looking here. Likely hoping for food. Hello there. Hi, you pilgrim. I never let my horse use your water trough. You help yourself. It's about all we got to offer. Thanks. The Drexel agent around here. Is that who you're looking for, the Drexel man? Yes. The name is Beasley. It has a room over Farrah Jim's place. I understand he's ready to pay for the capture of this man. Oh, you saw those notices, huh? $10,000. What do you pay? Yes, $10,000. That's all. Nothing but a fortune. Maybe I can show him the man he's after. Well, go on and do it.  What's that? I'm a man without a cent. The gold mine is one of the best around here. But for lack of a few hundred dollars, I can't operate till I hit the pay-dirt. Can't borrow the cash. And I'm watching my wife go hungry. But I'd see Sarah starve to death before I'd take the Drexel cash for shooting the Lone Ranger. Oh, uh, mind if I sit down for a minute?  I thought the real Lone Ranger was in Texas. Well, he's not. We've heard of things around here. And you can take it from me. The real Lone Ranger is back of him. He is?  If he'd come here, I'd find plenty of things that need cleaning up. He's just the fight machine to do it. That's why the Drexel outfit to have everyone around here ready to shoot them all in sight. Well, for example, uh... You mean what should be done? Yes. All right, take Potter. Before that agent Beasley came here, good minds like Potter didn't get blowed to miss smithereens. Then they go around fighting one another. They helped each other. They weren't suspicious of everyone and his brother. Beasley has changed all that. When he wants a mine, he finds a way to get it. When a man has a good mind like I've got, Beasley sees that he can't get cash to work it to the pay dirt. What will happen if you don't work your mind? Well, if there's no work on it for a certain time, I'll lose it. The ground can be staked all over again. Then Beasley gets it. I offered to sell out for $1,000. You know what Beasley did? He laughed at me. $1,000? A mine that's worth a million. He wouldn't pay me enough to take sir and me back east. No, sir, he'll wait. Get it for nothing. Does Beasley know what the land is worth? Surely he knows. That's his business at duty. Verne Gardner.  He is. Maybe so. I'm sorry, Stringy. Well, that's all right, Verne. It just rides me, that's all.  I know the man that can make things right around here. Then you talk of shooting this man. Well, I can't hold it again. Plenty of other men in town would do the same. I'm going to call on Mr. Beasley and see if he really will pay as much as the reward notice says. I'm sure we can't off your grub. Well, thanks, Verne. Thanks just the same. Maybe I'll see you again.   He's a nice spoken gentleman. I shouldn't have said what I did. I don't know about that, Verne. What do you mean? My pa used to raise horses, so I know him. What do you mean? That stranger's riding the best horse I ever saw. I wonder what he calls it. Before the lone ranger in disguise called on Beasley, he hurried out of town to meet Tonto. New plans were made based on things he had just learned. That evening, Tonto waited in the shadows behind the building while the lone ranger went inside Ferro Jim's café. He looked around for a minute and walked toward the back of a café where he spoke to a man who stood near the end of the bar. They call you Beasley, don't they? Yes, why? About a kind of the back room. What I have to say is private. Then what is it? All right. Go first. Who are you? What do you want? What do you know about this hand bill? Is it a reward on the level? That's what it says. Why? Well, this line about the lone ranger really being in Texas. What if that's not true? What if this man isn't a fake? I'm authorized to pay the reward. What do you know about him? I know where he's camping. You do? I wouldn't want to stop a silver bullet from one of those guns he uses. If you want to know the location, I'll sell the information. How much? One thousand dollars. A reason why you can't get the reward for yourself. You scared? I think that Indian with him has been watching me. Tell me where the camp is. If the information leads to the capture, dead or alive, I'll pay the thousand. Five hundred now. I rest later. Three hundred now. That suit you? Yes, I'll take it. Let me see the cash. Five, two, two, fifty, three hundred. There's the cash. Hey, what's that, the lamp? Duck, get on the table quick. Shoot, shoot! The ones here in this room came through the window. Do something, do something! Silver, you hear that? Silver, that horse! Beesley, they got away, or are you all right? Yes. Did he knock you down, too? No, that Indian he... The candle here, I'll light it. The cash was on the table. It's gone. And a bullet in its place. A silver bullet. The curtain falls on the first act of our Lone Ranger story. Before the next exciting scenes, please permit us to pause for just a few moments. Now to continue our story. Ten minutes have elapsed since the light in the rear room ferro gyms was shot out and Beesley's money taken from the table. Men who came to inquire about the noise and shooting were sent away. Another lamp was lighted and Beesley spoke to the man across the table. That page is a three hundred. It was on the table. It's your cash it was stolen. What about it? You promised to tell me where the Lone Ranger's camp was. Not much use now. What we said here was probably overheard. The camp will be moved. Yeah. Yeah. I suppose that's right. But where was it? Half a mile south of town in the woods at the bend in Durham Creek. I suppose it just as you said, he'll move the camp now. You needn't complain. You're out just three hundred dollars. I'd have had more than that if you'd captured the man you want. You can still get that reward. Maybe I'll try for it. I'd like to meet that Indian that was here. Several days later, Beesley heard that Vern Gardner had men working at his mine. Adding there, he met Potter on the way. Keep going, Beesley. Go and see something and it'll make you downright alien. Is it true that Gardner's got men working at his tunnel? You don't go on right, it's true. None of the men you've got scared half to death loaned him a cash either. They get the money to go on with the job. He was left with him. Three hundred dollars. Left mysterious in a night with a silver bullet alongside it to show who it was from. The Lone Ranger. Hey, look yonder. There's poor old Vern's place. He's got the dirt to fly now. He'll hit the pay dirt any day. And now he wouldn't sell you at any price. I don't know why you're laughing, Potter. Your own mind is caved in. I'll get it reopened. There's another thing, Beesley. I know who's to blame for it being blown up.   You'd better make any charges. You can't prove, Potter. When I make charges, I'll prove them and don't forget that. Hey, Vern! Hey there, Potter. Come and see how Mattila's progressing. Do a first rig. Mr. Beesley is real interested now. Yeah.  Almost any day I'm gonna hit the pay dirt. I haven't made any offer to buy your land. I'm just telling you to save you the trouble, that's all. This way till I hit pay dirt, you won't scare me from letting money to the men that need it. You weren't talking so loud a few days ago. $300 won't last. It'll last long enough. You wait and see. Now get off my property. Come on, Potter. Look it over. Yeah, I'd like to see it, Vern. There's not a man around here that's more deserving of a little good luck than you are. I'll show you the tunnel and the samples that make me sure we're almost a pay dirt. Then we'll go to the house and I'll show you a silver bullet. I gotta do something about that money. I gotta do something to hurry. Can't take chances, either. Beesley turned his back on Gardner's tunnel and headed back to the center of town. While he walked, his mind ran over various ways to stop the work. He was so absorbed in thoughts that he didn't notice the man on the path ahead until he was quite close. Oh, you again, huh? So you looked over the Gardner job? Yes. You, uh, need work done there? Huh? I haven't got the last money you gave me. I still need cash. What do you know about, uh, tunnels? Enough. Yes? I also know how to use blasting powder. What are you getting at? I don't think you'd find it easy to get someone to blast another tunnel for you. Why do you say that? The men have been pretty mad since Potter's explosion. I didn't have anything to do with that. That's the point, Beesley. If you had done it yourself, you'd have no problem. You could do the same to Gardner, but when it comes to hiring a job done, it's a different matter. You don't, uh, you don't seem to care what you do for cash, do you? Money has a loud voice. Did you learn anything new about the loan, the masked man that calls himself the Lone Ranger? I guess there's pretty good evidence that he's no impostor, isn't there? Oh, so you heard where Gardner got his cash. Yes, I, uh, knew about it. I asked a question. I know the Lone Ranger's moved his camp. I found that out. Do you know where the new camp is? I want more cash than you'd pay for that information. I'll do better than 300? Not interested, Beesley? 500. No. The job I'm after is one that is worth a lot more. If you can get the Gardner property for nothing, you'd get something pretty nice. Now, uh, wouldn't you? Well... That mind should be worth millions. It's a mighty lot of money. What's it worth to you to have a blast there? One that, uh, one that would fill up the tunnels. At least it would fill the mouth of the tunnel. Guaranteed? Oh, you needn't even pay your satisfied with the work. You come to my room. Maybe we can talk business. In the darkness of night, the Lone Ranger and Tonto work with feverish haste, digging holes and packing them with blasting powder. Like a mistake in this tunnel, they do burn Gardner more harm than good. Matt Ryan, now tamp this powder down. I've got the fuses in. Uh, when you, when you get cash from Beesley... Tonight, as soon as he's satisfied that the job is done the way he wants it. Matt would. We take big risk other time when you yell for silver out of window. Beesley would have been surprised to know he's the same when he thought he heard outside. Yeah, that'll do. I'm gonna meet him near that pile of rocks. Uh, you've got all of the plan made? Yes. Uh, it not like first plan. Why not, Tonto? It's a matter with our idea. Oh, there plenty risk. There's always risk, Tonto. A risk in everything worthwhile. The men who work these mines risk their lives and the lives of their families to get a foothold in these hills. That's right. But Tonto's still not like plan. I don't know of any other way to work things out. After all, we still have guns to find our way clear. A scout in silver to carry us. Let's get to work now and finish getting the powder placed. We've got a lot of work before midnight. I don't know why we couldn't have ridden here. It's hard walking at night. Horses would make a lot of noise, Beesley. Yeah, who'd hear it? Hearest houses burn gardeners and it's a long way from this tunnel. There might be men there than we think. It's best to go on foot. You'll realize that later on. Are you sure you've got enough powder in place? Yes. I'll take care of my end of the job. Just be sure about the money. Here we are. Here? Right. This pile of rocks will protect you when the blast goes off. Yeah, it's a good thing people around here know that... know that I don't know how to use blasting powder. I'd be blamed for this. Oh, you'll be blamed anyway. But as long as there's no proof against you, what do you care? Oh, I don't. You've got the cash with you, haven't you, Beesley? Of course. Moon's coming up now. You can see the entrance to the tunnel.  Get this over with. I don't want to see the entrance. I want to close with tons of ore. You wait right here then. I'll go and light the fuse. Long ranger hurry to the tunnel and disappeared inside. Whispered tensely to Tutto. One minute, Tutto. Let me get my own clothes on. It's good to get out of these old ones. She was ready to light. Just a second now. Yeah, your mask. Good. Oh, he's strapped gunned up in place. All right. I'll see you. Thank you. And here, hat. You have the old clothes. Let me take them away. Put them in the saddlebag. You'll take care of the horses, won't you? Oh, I'm at right. All right. You can light those fuses, Kimosami. I'll circle the rocks and speak to Beesley from behind his bag. And as soon he didn't see me in these clothes until he's handed over the cash. A match flamed against the fuse. There were sparks and a fast sputtering as Tutto slipped quickly away. The Indian paused outside the tunnel, lighted a second fuse and disappeared. A moment later, an ear-splitting blast rocked the earth. How about it, Beesley? Are you satisfied? I sure am. Gardner won't move that dirt for some time. Well, that's a better job than what's done on Porter's tunnel. Hey, off then. I haven't got the cash right here. You did a first-class job. Glad to pay you. I should. I have changed my clothes since the last time you saw me, Beesley. Last. You, the lone ranger. Why you? The lone ranger. You hear that? Hey, what's this? We got you, Beesley. We got you dead to rights. Gardner, Porter, coming. Your dog gone right. We was right behind those rocks. Heard every word it was said. Double-crossed. You tricked me. That's right, Beesley. You've been tricked. A thousand dollars you paid will go a long way toward repairing the damage to Gardner's tunnel. We got proof in your own stateless, Beesley, that you're responsible for the blowing up of my tunnel, too. But you and your firm will have to make that good. He's right, Beesley. These men have evidence enough to jail you for life if they want to use it. They might dismiss their charges if you make good your damage. No, wait, wait, man. Wait, listen to me. It was this man, the lone ranger. That is, he calls himself the lone ranger. He blew up Gardner's tunnel. You hide him and do it. That's all we need to know. You said he wasn't really the lone ranger while you were in Recoyola. No, no, no. Wait, boys. Let me talk. Don't be too hard with me. I acted under orders. I'll do what I can to make good the damage. I'll pay. It's the truest thing you ever said, Beesley.  Your power smashed to smithereens, Beesley.  There's one thing more. He'll... What about the reward? What? $10,000 for my capture. The Drexel Company is to pay that, isn't it? Oh, now, don't you... Here I am, Beesley. Just as described on your handbills. Gardner, Potter and their friends are turning me over to you, and they claim the reward. Now, there's a limit to everything. That's right. I will not open the mines. I'll repair the damage I'm charged with doing. I'll do that. And it's my cash that started Gardner back to work on his property. Oh, no, Beesley. That was my cash. Remember? You gave it to me for information about the Lone Ranger's camp. This other money was paid me for firing a blast at Gardner's tunnel. You haven't spent any of your own cash at Drexel... I'll reopen the tunnel. And you'll pay the reward.  You win. Bring up the horses, tunnel. Uh, me come. Well, Beesley, I'm your prisoner because you're paying the reward for my capture. Now, uh, what are you going to do with me? Do? With you? Yes. Are you going to order me jail? Well, I... Well, it's different than you figured, isn't it? You didn't count on having me alive. Oh, it's ready, Kim. Sorry. Wait, tunnel. Beesley is deciding what he's going to do with a prisoner that's cost him $10,000. Hurry up, Beesley. Wake up your mind so we can go to your office and get our cash. I'll pay the reward, but... but men, put down your guns. I'll... I'll drop any... any charges against this mass man. Please, please, Mr. Go-Away. Go-Away before you think of something else. Kelly Silver. Ready, tunnel? Uh-huh. Are you ready? I hear any more bad reports about you, Beesley. I'll be back. And you will need handbills to bring me. Come on, tunnel. Get him up, scoundrel. Get him up, scoundrel! Go-Away!


Okay. All right, welcome to the January 2022 Board of Zoning Appeals meeting. Members, staff, and guests, we ask for your patience during this hybrid meeting. Multiple staff members are behind the scenes to make sure all applicants and citizens are able to communicate with the board at the appropriate times. The first option is to stream the meeting via the two links below that are posted on the screen. The second option is the public can submit letters and options via email leading up to and during the meeting at the email address, COC board meeting at columbiasc.gov. And the third option for participation is to call in via phone dial 1-855-925-2801. And when prompted, please enter meeting code 2886. Press star one to listen. Star two to leave a voicemail to be read into the record. Star three to be placed into a queue to speak live when prompted. Please wait until your case is called to hit star three. If participating by phone while also streaming the meeting on computer, please mute the audio on your computer and only use phone audio so as to avoid audio issues when being patched into Zoom meeting to speak. There's a large audio delay between Zoom and the live recording on citytvandpublicinput.com. We will pause at certain times to allow the audio to catch up and give citizens time to submit comments. We'll proceed with the roll call. Mr. Dinkins. Here. Mr. Gregory is absent today. Mr. Primus is also absent. Ms. Finner. Here. Mr. Gignard. Here. Ms. McIntosh. Here. And Mr. Duvall is also absent as well. Okay, thank you. Applicants with request before the Board of Zoning Appeals are allotted a presentation time of 10 minutes. This time should include but is not limited to an overview of the project, case history, and any pertinent meetings held regarding the request. This time also includes all persons presenting information on behalf of the applicant, such as attorneys, engineers, and architects. This time limit does not include any questions asked by the Board of Zoning Appeals or staff regarding the request. Any member of the general public may address the Board in intervals of three minutes, or five minutes if by a spokesperson for an established body or for a group of three or more. The applicant will then have five minutes for rebuttal. The Board reserves the right to amend these procedures on a case-by-case basis. Okay, those of you who plan to speak must be sworn. If you are here as an applicant or here to speak on any case, please stand at this time and raise your right hand. Okay, do you affirm or attest that the testimony you will give today is the truth and nothing but the truth? Thank you. Moving on to the consent agenda, the Board uses the consent agenda to approve non-controversial or routine matters by a single motion and vote. If a member of the Board or the general public wishes to discuss an item on the consent agenda, that item is removed and placed on the regular agenda. The Board then approves the remaining consent agenda items. The first item on the consent agenda is the approval of the December 2nd, 2021 meeting minutes. The second item on the consent agenda is case 2021-0103-SE 716 Hugie Street. It's a special exception request to permit an alternative parking surface for a parking light use. Does anyone wish to speak on a case which would remove the case from the consent agenda prior to the Board vote? This time we'll pause to give the audio time to catch up. Okay, at this time there are no comments by members of the public. Okay, well, I'd like to ask for a motion. Okay, we have a motion to second. All those in favor, please say aye. Aye. Any opposed? All right, motion passes. Okay, any other business? No, that's it for today. All right, well, okay, I'm going to second all those in favor, please say aye. Aye. Aye. All right. Thanks, I'll have a good week. Okay.


Hi and welcome to our session. Let us discuss the following question. The question says the mean of the falling frequency distribution is 57.6 and the sum of the observations is 50. Find the missing frequency F1 and F2. Now this is the distribution given to us and we have to find the missing frequency F1 and F2. Let's now begin with the solution. We will first make a table and in the first two columns we have written and given information. In the third column we will now find midpoint of each class interval and we denote midpoint by xi. A midpoint of this class interval is 10 as 0 plus 20 divided by 2 gives us 10. Then we have 20 plus 40 divided by 2 which is equal to 40. Then we have 50, 70, 90, 110. Find product of F i and xi. 7 into 10 is 70. F1 into 30 is 30 F1. 12 into 50 is 600. 20 is 725 into 110 is 550.