In this ppt I have included mainly three topics. 1.Introduction of IDS 2.Technologies used in IDS 3.Detection types

1. Seminar on Intrusion Detection System

3. Technologies

5. History

6. Need of IDS

8. The possibilities and opportunities are limitless.

10. Definition: Intrusion Detection System (IDS) is a software to determine if a computer network or server has experienced an unauthorized intrusion.

11. IDS detects these intrusion attempts so that action may be takento repair the damage later. IDS monitors network traffic and monitors for suspicious activity and alerts the system or network administrator.

12. The beginning(History) A USAF paper published in October 1972 written by James P. Anderson outlined the fact the USAF had “become increasingly aware of computer security problems.”

14. Confidentiality:Whether the information stored on a system is protected against unauthorized access. Need of IDS

19. Tasks to be performed Simulation Analysis Notification

21. Technologies:

23. Real-time monitoring of networks

24. Provide information about attacks that have succeeded

26. E.G., Packet sniffing via tcpdump at routers

27. Inspecting network traffic

28. Watch for violations of protocols and unusual connection patterns

29. Monitoring user activities

31. May be easily defeated by encryption Data portions and some header information can be encrypted The decryption engine still there.

33. www.ethereal.com offers:

34. Windows

35. UNIX, e.g., www.ethereal.com/download.html

38. No packet filter drops

39. Real-time notification

40. Mechanism separate from policy

41. Extensible

42. Broad detection coverage

43. Economy in resource usage

44. Resilience to stress

46. E.G., BSM on Solaris: logs all direct or indirect events generated by a user

47. strace for system calls made by a program

48. Monitoring user activities

50. E.G., Analyze system calls made by sendmail

54. border router or multiple sensors within a LAN

55. Match sniffed tracffic with signatures

56. attack signatures in database

57. Signature: set of rules pertaining to a typical intrusion activity

58. Simple example rule: any ICMP packet > 10,000 bytes

60. can configure IDS to exclude certain signatures; can modify signature parameters

61. Warn administrator when signature matches.

62. send e-mail, SMS

64. Blind to unknown attacks

65. Signature bases are getting larger

66. Every packet must be compared with each signature

68. Create normal traffic profile

69. Look for packet streams that are statistically unusual

70. e.g., inordinate percentage of ICMP packet

71. or exponential growth in port scans/sweeps

72. Doesn’t rely on having previous knowledge of attack

73. Research topic in security