Know your enemy or Second Line Intrusion Detection …

• Provides the following:
– Detailed access starts from server page address.html – Page cline.html leads to two links:
– Cline-bisttrom.html and – Cline-stella.html
– So far, results are good, but not great – enough penetration is undetected
Behavior Analysis Application
• A JAVA application that classifies behavior is partially done and operational
4. Construct input benchmarks 5. Continue work on Other Types of Entry Modes
More to come
• Examples of more complex relationships to be explored
– Server pages link to other servers pages – Same source (IP) for different communication types – Accessing different locations on tree concurrently
– Can be done by using two copies of the browser – The two sessions will have different Ids but may be cooperating – The agents monitoring the two browsers must collaborate
– Example 2 seems as an unordered set of program statements
• Therefore Example 2 does not seem to be a “regular” access pattern
Prototype Design Details
Comments on Example 2
• Access starts straight from a couple of internal pages (i.e., nodes of the tree) • It continues by a visit to a link off the home page • Summary:
– It shows a high level of detection of irregular behavior
• The approach is promising and has a proven track record
• Web Browser communication performance improved by 20% by changing cache to use Next URL Prediction • Prediction is based on the underlining assumption of “regularity” of behavior
Introduction
• Penetration into computer systems continues at a high rate despite substantial progress in security research and technology • No reason to assume that this level of “insecurity” will change • Most penetrations are done by individuals or small teams • Only lately has personalization entered into security consideration
• In addition to URLs, one should watch out for:
– – – – FTP access E-mail Potential Logins Other protocols access: e.g., port scanning • FTPs port are predefined • E-mail, except for bugs, can be protected against • Port scanning is already trapped by IDS
Second Line Intrusion Detection Using Personalization
DISA Sponsored GWU-CS
Content
1. 2. 3. 4. 5. Introduction Examples and Analysis Prototype Design More to come Conclusion
• On a “sound” server:
Prototype Design
• We face suspicious behavior with two tools
– Automatic recognition
• Machine Learning • Data Mining
• Automatic recognition may be trained on “regular’ access patterns and attempt detection of “irregular” access patterns
• Our research into personalization in areas such as:
– User command lines behavior (e.g., UNIX) – User browser patterns as reflected by URL sequences – User work habits
• URLs and FTPs from same source at the same time • Multiple FTPs
– Similar case to multiple browsers
• ...
Conclusion
• A substantial prototype will be completed by end of Summer • Complex relationships will be explored:
– The behavior does not follow regular access patterns – The behavior is difficult to explain – This access may indicate suspicious behavior
Other Types of Entry Modes
• The example demonstrates “reasonable” behavior
Example 2
/mmfa9.html /rehs10.html /stern3.html /address.html /trotter41.html /cantor8.html
• Provides a basis for:
– – – – User classification Abnormality observation Detection of deviation from regular behavior Changes in patterns
Examples and Analysis
Observation
• URL, IP packets, and Port scanning look like an algorithm (or a program) without termination
– Example can be written as:
Initialize; Initialize; /address.html Loop; rest of URLs • The loop is a while that selects links in /address.html for viewing • The selection criterion is personal
Comments on Example 1
• Assumptions:
– Access to server is through home page – Knowledge of structure and content of server pages
/address.html /cline.html /cline-bisttram.html /cline-stella2.html /karges.html /karges1.html /karges3.html /karges8.html /mmfa.html /mmfa1.html /mmfa9.html
STEPS 1. Analyze Server pages hierarchy 2. Analyze each page for links and sources (i.e. src) files 3. Build an identification engine based on
1. Behavior categorization 2. Page hierarchy 3. Isolation of individual users to identifying agents
– Threats will be enumerated – Potential detection will be proposed – Prototype will include some of these results