Intrusion Detection Systems: Evolution and Detection Methods

Intrusion Detection Systems: Evolution and Detection Methods

Introduction

The Transmission Control Protocol over Internet Protocol (TCP/IP), over the years, became one of the most successful networking protocol stacks and is now universally used as described by Vacca (2013). A computer network is a series of computers that are connected, communicate and share information and data. The Internet runs on the TCP/IP network protocol stack, and a vast majority of enterprise and government networks have implemented TCP/IP on their internal networks known as Intranets. Due to the popularity of the networking protocol, most attacks against computer systems seen today are built for and carried out over TCP/IP networks, and hence most prevention and intrusion detection tools are created to work with and monitor TCP/IP based networks (Vacca, 2013, p. 126). The annual number of network data breaches have gone from 781 in 2015 to 1,093 in 2016 or a 30% increase in one year as ITRC (2016) points out.

Information security is the focus on integrity, availability, confidentiality, and accessibility of data processed and stored on information systems (Vacca, 2013, p. 119). A computer intrusion is an effort to compromise the privacy, reliability, availability of a source and is able to evade the security layers installed on the network or computer system (Tsai & Yu, 2014, p. 39). A bad actor that wants to access an information system could come from many places. The bad actor(s) could be an internal or insider threat that breaches the confidentiality, integrity or availability of the system or the bad actor(s) may be an outsider (Vacca, 2013, p. 120). Another way to breach information systems, as discussed by Vacca (2013) is using malware to gain access. All the intrusions are put to use to breach an information system.

The Intrusion Detection System (IDS) is one layer of information security installed to protect information systems from the bad actor(s) (Vacca, 2013, p. 127). Intrusion detection and prevention methods usually are not a single tool or product. Usually, the intrusion detection and prevention systems is a series of layered hardware and software technologies and human resources with a specific security analysis skill set and the appropriate information security methodologies implemented at the company or organization. Examples of intrusion detection products are the network-based intrusion detection system (NIDS), network-based intrusion prevention system (NIPS), and host-based intrusion prevention system (HIPS) (Singh & Singh, 2014, p. 361). The other tools used are network and session monitoring and analysis tools.

The paper will cover aspects of IDS that are used by companies and organizations to protect themselves from bad actors trying to penetrate company computing systems and network infrastructure thus increasing the company or organizations security posture. The paper will explain the evolution of intrusion detection products which includes NIDS, NIPS, and HIPS along with the methods of detection. This paper will discuss signature and anomaly-based detection methods and their strengths and weaknesses but will not include physical security or wireless IDS’s.

Intrusion Detection Evolution

TCP/IP Network Evolution

TCP/IP, developed in 1968, by the Defense Advanced Research Project Agency (DARPA) as Trost (2009) points out, on its network named Advanced Research Projects Agency Network (ARPANET) and in 1970 began to use it in full production. The Office of the Secretary of Defense, in July 1980, decreed that the Department of Defense (DOD) use TCP/IP protocols on all DOD networks. The standard protocols implemented on the DOD systems were created based on Request for Comments (RFC) 791 Internet Protocol and RFC 793 Transmission Control Protocol.

While one uses the Internet or Intranet the hosts on the network communicate by using a software mechanism called layers. TCP/IP has various protocols, and these protocols are related to the four TCP/IP Layers as Trost (2009) discusses. The International Telecommunication Union (ITU) and International Standards Organization (ISO) standards organizations had network layer models, and in 1984, the two standards were combined and released as the Open Systems Interconnection (OSI) reference model now commonly referred to as the OSI Model. The OSI Model and TCP/IP layers are similar as Trost (2009) points out. The OSI Model has seven layers, and TCP/IP has four layers. The OSI model includes the application, presentation, session, transport, network, data link, and physical layers from top to bottom while the TCP/IP, from the top to bottom layers, are an application, transport, internet, and link. The TCP/IP application layer, as Trost (2009) points out correlates to three layers of the OS Model which are application presentation and session. The transport layer is the same for TCP/IP, and OSI Model and the Internet layer in the TCP/IP layer corresponds to the network layer on the OSI Model. The bottom TCP/IP layer is the Link layer, and it corresponds to the bottom two layers of the OSI Model which are the data link and physical layers. With the TCP/IP protocol comes the continuous battle with illegal activities that occur over the TCP/IP protocol stack. Network security teams worldwide participate in the invocation fo the TCP/IP network, as students, inventor or professionals of information systems and technology.

The First Intrusion Detection Systems

Looking back in time the first person to propose the concept of intrusion detection was James Anderson in the 1980’s. The idea put forth was to monitor security threats through audit trails ((Tsai & Yu, 2014. p. 41). Anderson discussed attacks and intrusions along with vulnerabilities by a design flaw that enable bad actors system intrusions to occur. Anderson identifies basic intrusion detection terminologies such as threat, risk, vulnerability, attack, and penetration and reviews the technologies involved along with the positive and negative aspects of intrusion detection. A threat is a possibility of deliberate or unauthorized attempt to access, manipulate information or makes an operating system or application unreliable or unusable (McHugh, 2001, p. 15). A risk identified as accidental or unpredictable exposure to data or the violation of operations integrity due to malfunction of hardware or a software design that was not created correctly or not completed. A vulnerability is a flaw that is suspect or known in computer software or hardware that exposes an information system accidental disclosure of data or information. An attack is identified as a specific plan executed or created to act on a threat. A bad actor(s) that successfully attacks a target and gains unauthorized access to information, programs or takes control of a computer system is called penetration (McHugh, 2001, p. 15).

Robert Morris released a worm that unintentionally made its way to the Internet and disabled thousands of Unix and Vax workstations in 1988, and once this worm caused issues, three different IDS systems were created. The Intrusion Detection Expert System (IDES), Haystack Multics Intrusion Detection and Alerting System (MIDAS), all IDSs made there debut in the same year as the Morris worm in 1988 ((Tsai & Yu, 2014, p. 41).

The IDES was written to monitor the actions of users and was able to provide active or real-time detection of security violations on a single host system and was developed from the years 1984 to 1988. IDES, stored rules and was an intrusion detection system that was able to do active monitoring, signature and anomaly detection and is seen as the first time intrusion detection used active analysis of traffic (Kumar & Venugopalan, 2017, p. 358).

Techniques Used for Detection

Signature-based detection

A signature-based IDS identifies any packets that are the same as rules or signatures defined in the catalog or stored alerts as described by Singh & Singh (2014). An alert gets generated if the packet scanned matched the signature in the catalog and usually these catalogs are dynamically kept up to date with new vulnerabilities.

Signature-based intrusion detection as described by Kumar & Venugopalan (2017) point out that this method of detection is useful for known patterns of attack and vulnerabilities. In some cases the signature-based intrusion detection identifies partial attack attempts also known as a partial signature (Kumar & Venugopalan, 2017, p. 362). The advantage of the signature-based method is it is able to detect intrusions accurately based on the signatures stored in the database and generates fewer false alarms than an anomaly-based intrusion detection system (Kumar & Venugopalan, 2017, p. 362). The disadvantage of the signature-based detection is that it is unable to detect unique or unidentified attacks.

Anomaly-based Detection

The IDS, that is anomaly based, uses pattern identification from already identified patterns learned by monitoring network traffic (Singh & Singh, 2014, p 42). The anomaly-based method looks for differences that might identify the packet as a masquerade. The anomaly-based method uses more computing power than a signature-based detection system. The computer power is used by the anomaly detection system to analyze current network behavior by comparing it to the past audits collected (Singh & Singh, 2014, p 42).

The anomaly-based intrusion detection monitors traffic and establishes a baseline. A baseline is formed by monitoring the network traffic for a period of time. Once a baseline is established, intrusions are identified based on anomaly detected from the baseline or normal traffic patterns (Kumar & Venugopalan, 2017, p. 362). In other words, the anomaly-based detection method identifies attacks based on deviations from the normal behavior and this type of detection system has the ability to detect unknown intrusion attacks. Advantages of anomaly-based intrusion detection systems are they are able to identify new attacks, are to a lesser amount of dependent on operation system-specific mechanisms, enable the ability to detect abuse of privileges and typically have a high amount of false alarms (Kumar & Venugopalan, 2017, p. 362). A disadvantage of anomaly-based systems is that it is incapable of identifying an attack while establishing a baseline of system traffic. Other disadvantages are that a behavior change over time causes the system to perform poorly, an entire scope of behavior is not normally covered during a behavior learning phase, and the high false-alarm limited by training data (Kumar & Venugopalan, 2017, p. 362).

Methods of Intrusion Detection Systems

An intrusion is an unauthorized attempt to manipulate, take ownership or access the company’s information system or network. In some cases, they render the system useless or make them defective or unusable. The process of intrusion detection is to observe events occurring on the system to understand if there has been a possible bad actor or intruder present (Kumar & Venugopalan, 2017. P. 356). Intrusion detection, which is a traditional method, identifies attacks after they already exist on the network as Kabiri (2012) points out. Intrusion prevention, which is a proactive method, stops attacks from entering the network. Unfortunately, attackers still bypass the intrusion prevention systems as Kabiri (2012) discusses. Combining the IDS and IPS takes advantage of old-style and pre-emptive methods with the goal of excluding some of the limits of both systems. The use of active traffic splitters on the traffic is an option when monitoring with the goal of reducing the load on sensors, thereby improving performance in the detection and prevention of an intrusion.

Intrusion Detection and Prevention Systems

The IDS is a vital piece in the information security layers of a companies or organizations network security (Kumar & Venugopalan, 2017. P. 356). The IDS can be implemented by hardware appliance or a software application running on a server. The primary goal of the IDS is to protect the information systems from unauthorized access. The IDS can be classified into two categories (Yeo, Che & Lakkaraju, 2017, p. 4). The categories are passive or active and is based on the response during an attack of a bad actor. The passive IDS alerts the security team, records the attack and collects logs and records of what occurred. A passive IDS is normally placed off to the side of a network.

The active IDS has the ability to take actions after the detection of an intrusion alert. The active IDS can block further traffic from the attack address or even lock the system and network into a safe mode. The active IDS is also known as an Intrusion Prevention System (IPS). The primary purpose of an IPS is to step in or suspend any incidents of a suspected attack. An IPS is primarily a mixture of access control devices. Examples are firewalls and IDSs. The IPS has additional capabilities compared to the IDS in that the IPS can control access capabilities and activate immediate responses to a suspected attack as described by Yeo et al. (2017). The IPS can use anomaly or signature-based rules to detect suspected attacks.

Network Intrusion Detection Systems (NIDS)

The primary purpose a network-based IDS is examining and monitoring network traffic for potential intrusions. The NIDS scans and reads every network packet to find patterns (Kumar & Venugopalan, 2017. P. 363). The NIDS operates in three different modes. An NIDS can operate in signature detection mode, anomaly detection mode, or a hybrid of both signature and anomaly modes. The signature-based NIDS works by passively monitoring network traffic traveling by the sensors interface(s) and inspects the TCP/IP packets for signatures of known attacks (Vacca, 2013, p. 133).

The packet headers of TCP/IP can be inspected to look for inconsistent header content that is used by bad actors to attempt to bypass monitoring and filter devices. The signature-based NIDS will not identify any attack it does not have a signature for in its catalog or database (Vacca, 2013, p. 133). Not having the ability to identify signatures which exist in the catalog or database is a severe limitation, but the signature-based NIDS are useful because the NDIS has the functionality to allow an operator to configure any custom signature(s) to a sensor(s). Engineers can quickly deploy the NIDS which provides the ability to monitor and alarm on the network(s) in the event one discovers a suspicious activity or an incident. The signature-based NIDS benefit the information security engineering team members because the NDIS monitors for all known-attacks and free up the team members to investigate or monitor new or unknown threats. The NIDS is used for identifying anomalies of the network traffic and assemble statistical models (Vacca, 2013, p. 134).

The NIDS hybrid system makes use of the optimum components of a signature and anomaly-based detection and combines the components or features into one system which overcome the weaknesses of both models (Vacca, 2013, p. 134). NIDS now commonly implement a hybrid system that utilizes signature matching with speed and flexibility and include anomaly detection to flag suspicious network traffic flow for further review by security analysts in charge of tracking NDIS alert network activity.

The main criticism of the NDIS is the reliance on static signatures (Vacca, 2013, p. 134). The next in the line of criticisms for the NDIS is they tend to produce a significant amount of false positive alerts due to poorly written alert rules, or the sensors were not tuned correctly. Another criticism is that the NDIS has the inability to monitor encrypted traffic and the NDIS is unable to handle 10 gigabits per second high-speed networks. The issue with the NIDS is the main reason people move to intrusion prevention systems instead of continuing using a NIDS (Vacca, 2013, p. 134).

Network Intrusion Prevention Systems (NIPS)

In the previous section, one understood that an NIDS system is a passive system. This section describes the NIPS. The NIPS is an active monitoring system that monitors live network traffic and will take action when a threat is identified (Datt, 2016, p. 116). A NIPS is usually positioned on the network before a firewall actively scanning packets. The intrusion of a network is regularly trailed or quickly followed by a vulnerability exploit(s). One example is by maliciously injecting data into an application or service with the mission of interrupting or overtaking a server or software application. In most scenarios in the information security industry, most exploits found by a bad actor(s) have a window of use before the exploit has been identified and the intrusion detection software vendor rush to get a patch out to customers. The NIPS plays a vital role in the layers of security defense set-up for a company or organization by stopping or terminating attacks before they can penetrate the network (Datt, 2016, p. 116).

Host-Based Intrusion Detection Systems (HIDS)

An IDS that operates on a computer, node or device referred to as a host-based IDS (HIDS) (Yeo et al., 2017, p. 2). The main functionality of the HIDS is internal monitoring. Some variations of the HIDS have been updated or changed to be used to monitor networks. The HIDS monitors and analyzes the internal systems and determines if it is compromised and if the system has been compromised the HIDS provides an alert or alarm to the security engineer. A HIDS can detect a rogue program that suspiciously accesses a system’s resources, or discovers a program that inserted, modified, or deleted a Microsoft Windows registry in a harmful way (Yeo et al., 2017, p. 2). The registry setting is used by the Microsoft operating system to store systems configurations.

The first type of intrusion detection software to be developed was HIDS (Yeo et al., 2017, p. 2). The HIDS has inspected the full communications stream if needed which is not like a network-based IDS. NIDS fragmentation attacks or session splicing avoidance methods are not pertinent to the HIDS because the HIDS inspects the entire session operating system it is running on (Yeo et al., 2017, p. 2). The operating system encrypted traffic is monitored by the HIDS before it is encrypted which allows the HIDS to match against common attacks and is not hindered by encryption methods in any way. Additional checks performed by a HIDS can be achieved such as file integrity checking, monitoring the registry, log scanning and the detection of a rootkit (Yeo et al., 2017, p. 2). The HIDS handles these types of functions because the HIDS gets installed on the host machine it is monitoring.

Conclusion

The protection of an information system and the network is usually achieved by building layers of security to defend against bad actors penetrating the company or organizations information systems. Various security tools are deployed for protection. This paper summarized the types of IDS and IPS systems that can assist in one or more layers of security to keep unauthorized network traffic out and prevent stealing of sensitive or proprietary information wanted by bad actors or unauthorized people or groups. The paper distinguished between signature-based and anomaly-based network monitoring. Looked at different sytles of montoring for detecting intrusions and how some styles of intrusion detection use active and passive monitor the information system networks to understand what is standard traffic and when to flag or disable traffic that is non-standard or suspect until the security team gain an understanding of the alert or issue that was reported. Bad actor(s) continuously reinvent new methodologies to break into networks and having various types of intrusion detection tools in place and building layers of security into the inormation system will lower the risk and frequency of attacks.

References

Datt, S. (2016). Learning network forensics. Birmingham, United Kingdom: Packt Publishing.

Identity Theft Resource Center. (2016). Data breach reports: 2016 end of year report. Identity Theft Resource Center.

Kabiri, P. (2012). Privacy, intrusion detection, and response: Technologies for protecting networks. Hershey, PA: IGI Global.

Kumar, D. A., & Venugopalan, S. (2017). Intrusion detection systems: A review. International Journal of Advanced Research in Computer Science.

McHugh, J. (2001). Intrusion and intrusion detection. International Journal of Information Security, 1(1), 14-35.

Singh, A. P., & Singh, M. D. (2014). Analysis of host-based and network-based intrusion detection system . International Journal of Computer Network and Information Security, 6(8), 41-47.

Trost, R. (2009). Practical intrusion analysis: Prevention and detection for the twenty-first century. Addison-Wesley Professional.

Tsai, J. J. P., & Yu, Z. (2014). Intrusion detection: A machine learning approach. Imperial College Press.

Vacca, J. R. (2013). Managing information security (2nd ed.). Waltham, MA: Syngress.

Yeo, L. H., Che, X., & Lakkaraju, S. (2017). Modern intrusion detection systems (arXiv preprint arXiv:1708.07174).