Once, protecting a local network required nothing more than a standard firewall and antivirus software, but against modern hackers and the increasing prevalence of malware, this combination is no longer effective enough. The good old firewall only analyzes packet headers, allowing or blocking them according to a set of formal rules. It knows nothing about the contents of the packets, which means it cannot recognize seemingly legitimate actions by attackers. Antivirus programs do not always catch malicious software, so the administrator faces the challenge of monitoring abnormal activity and promptly isolating infected hosts.
There are many advanced tools available to protect a company's IT infrastructure. Today, we will discuss open-source intrusion detection and prevention systems that can be implemented without purchasing expensive hardware and software licenses.
IDS/IPS Classification
An IDS (Intrusion Detection System) is designed to log suspicious activities on a network or a single computer. It keeps an event log and alerts the responsible information security personnel. Within an IDS, the following components can be identified:
- sensors for monitoring network traffic, various logs, etc.
- an analysis subsystem that detects signs of malicious activity in the received data;
- a storage facility for accumulating primary events and analysis results;
- a management console.
Initially, IDS were classified by their location: they could be targeted to protect individual hosts (host-based or Host Intrusion Detection System — HIDS) or to protect the entire corporate network (network-based or Network Intrusion Detection System — NIDS). It's worth mentioning the so-called APIDS (Application protocol-based IDS): they monitor a limited set of application layer protocols to identify specific attacks and do not perform deep packet analysis. Such products typically resemble proxies and are used to protect specific services: web servers and web applications (for instance, those written in PHP), database servers, and so on. A typical representative of this class is mod_security for the Apache web server.
We are more interested in versatile NIDS that support a wide range of communication protocols and deep packet inspection (DPI) technology. They monitor all incoming traffic, starting from the link layer, and detect a wide array of network attacks as well as unauthorized access attempts to information. Often, such systems feature a distributed architecture and can interact with various active network equipment. It's important to note that many modern NIDS are hybrid and combine multiple approaches. Depending on configuration and settings, they can handle different tasks — for example, protecting a single host or an entire network. Additionally, the functions of IDS for workstations have been taken over by antivirus packages, which, due to the prevalence of information-stealing Trojans, have evolved into multifunctional firewalls capable of recognizing and blocking suspicious traffic.
Originally, IDS could only detect malicious software activities, port scanner operations, or, say, violations of corporate security policies by users. Upon the occurrence of a certain event, they would notify the administrator, but it quickly became clear that simply recognizing an attack was not enough — it needed to be blocked. Thus, IDS transformed into IPS (Intrusion Prevention Systems) — systems that prevent intrusions and can interact with firewalls.
Detection methods
Modern solutions for intrusion detection and prevention utilize various methods for identifying malicious activities, which can be categorized into three groups. This provides us with another classification option for systems:
- Signature-based IDS/IPS detect patterns in traffic or monitor system state changes to identify network attacks or infection attempts. They have very few false positives but cannot detect unknown threats;
- Anomaly-based IDS do not use attack signatures. They recognize behaviors that deviate from normal for information systems (including anomalies in network traffic) and can identify even unknown attacks. Such systems generate a fair number of false positives and, if misconfigured, can paralyze local network operations;
- Rule-based IDS operate on the principle of: if FACT then ACTION. Essentially, they are expert systems with knowledge bases—a collection of facts and logical inference rules. Such solutions are labor-intensive to configure and require the administrator to have a detailed understanding of the network's operations.
History of IDS Development
The era of rapid development of the Internet and corporate networks began in the 1990s, but specialists began to tackle advanced network security technologies a bit earlier. In 1986, Dorothy Denning and Peter Neumann published the IDES (Intrusion Detection Expert System) model, which became the foundation for most modern intrusion detection systems. It utilized an expert system to identify known types of attacks, as well as statistical methods and user/system profiling. IDES ran on Sun workstations, monitoring network traffic and application data. In 1993, NIDES (Next-generation Intrusion Detection Expert System) was released—a next-generation expert intrusion detection system.
Based on the work of Denning and Neumann in 1988, the expert system MIDAS (Multics intrusion detection and alerting system) was created, which utilized P-BEST and LISP. During that time, a system called Haystack, based on statistical methods, was also developed. Another statistical anomaly detector, W&S (Wisdom & Sense), was developed a year later at the Los Alamos National Laboratory. The industry was advancing rapidly. For example, in 1990, the TIM (Time-based inductive machine) system already implemented anomaly detection using inductive learning on user sequential patterns (Common LISP language). NSM (Network Security Monitor) compared access matrices to detect anomalies, while ISOA (Information Security Officer’s Assistant) supported various detection strategies: statistical methods, profile checking, and an expert system. The system ComputerWatch created at AT&T Bell Labs utilized both statistical methods and rules for verification, and the first prototype of a distributed IDS, DIDS (Distributed intrusion detection system), was developed by the University of California as early as 1991, also functioning as an expert system.
Initially, IDS were proprietary, but by 1998, the Lawrence Berkeley National Laboratory released Bro (renamed Zeek in 2018) — an open-source system using its own rule language for analyzing libpcap data. In November of the same year, the libpcap packet sniffer APE was introduced, which was renamed Snort a month later, later becoming a full-fledged IDS/IPS. This was also when numerous proprietary solutions began to emerge.
Snort and Suricata
Many companies prefer free open-source IDS/IPS solutions. For a long time, the standard solution was Snort, mentioned earlier, but now it has been overshadowed by the Suricata system. Let's take a closer look at their advantages and disadvantages. Snort combines the advantages of signature methods with the ability to detect anomalies in real-time. Suricata also allows the use of other methods beyond signature-based attack recognition. The system was created by a group of developers who separated from the Snort project and has supported IPS functions since version 1.4, while the intrusion prevention capability in Snort was introduced later.
The main difference between the two popular products is Suricata's ability to utilize GPU for computations in IDS mode, as well as its more advanced IPS. The system is originally designed for multithreading, whereas Snort is a single-threaded product. Due to its long history and inherited code, it does not optimally utilize multiprocessor/multicore hardware platforms, while Suricata can handle traffic up to 10 Gbps on standard general-purpose computers. The similarities and differences between the two systems can be debated at length, but while the Suricata engine operates faster, this is not critically important for narrower channels.
Deployment Options
IPS needs to be placed in such a way that the system can monitor the network segments under its control. Most often, this is a dedicated computer with one interface connected after perimeter devices, 'watching' through them into unprotected public networks (the Internet). The other IPS interface connects at the entrance of the protected segment so that all traffic passes through the system and is analyzed. In more complex cases, there may be several protected segments: for example, in corporate networks, a demilitarized zone (DMZ) is often designated with publicly accessible services.
Such an IPS can prevent port scanning attempts or break-ins via password guessing, exploitation of vulnerabilities in mail servers, web servers, or scripts, as well as other types of external attacks. If computers in the local network become infected with malware, the IDS will prevent them from connecting to external botnet servers. For more serious protection of the internal network, a more complex configuration with a distributed system and expensive managed switches capable of mirroring traffic to one of the ports of the IDS interface is likely to be required.
Corporate networks frequently face distributed denial of service (DDoS) attacks. Although modern IDS can combat them, the deployment model mentioned above is unlikely to help here. The system detects malicious activity and blocks parasitic traffic, but for this to happen, packets must pass through an external internet connection and reach its network interface. Depending on the intensity of the attack, the data transmission channel may become overloaded, allowing the attackers to achieve their goal. For such cases, we recommend deploying the IDS on a virtual server with a deliberately more robust internet connection. A VPS can be connected to the local network via VPN, after which routing of all external traffic through it must be configured. In this way, in the event of a DDoS attack, packets will not have to traverse the provider's connection; they will be blocked at the external node.
The Choice Dilemma
Identifying a leader among free systems is quite challenging. The choice of IDS/IPS depends on the network topology, the required protection features, as well as the personal preferences of the administrator and their willingness to tinker with settings. Snort has a longer history and is better documented, although information on Suricata is also not difficult to find online. In any case, mastering the system will take some effort, which will ultimately pay off — commercial hardware and integrated hardware-software IDS/IPS can be quite expensive and often don't fit into the budget. There's no need to regret the time spent because a good admin continually improves their qualifications at their employer's expense. In this scenario, everyone benefits. In the next article, we will explore some deployment options for Suricata and practically compare this more modern system with the classic IDS/IPS Snort.
Source: habr.com
