Intrusion Tolerant IDS James Riordan Marc Dacier Dominique - - PowerPoint PPT Presentation

▶
intrusion tolerant ids
SMART_READER_LITE
LIVE PREVIEW

Intrusion Tolerant IDS James Riordan Marc Dacier Dominique - - PowerPoint PPT Presentation

Mar 13, 2023 217 likes •366 views

Intrusion Tolerant IDS James Riordan Marc Dacier Dominique Alessandri Andreas Wespi IBM Forschungslaboratorium R uschlikon, Switzerland 19 June 2001 1 MAFTIA A European project whose aim is to develop: Malicious- and Accidental-

slide-1
SLIDE 1

Intrusion Tolerant IDS

James Riordan Marc Dacier Dominique Alessandri Andreas Wespi IBM Forschungslaboratorium R¨ uschlikon, Switzerland 19 June 2001

slide-2
SLIDE 2

1

MAFTIA

A European project whose aim is to develop: Malicious- and Accidental- Fault Tolerance for Internet Applications In short: apply and develop dependability methods with respect to a malicious fault model.

slide-3
SLIDE 3

2

Maftia Details

Maftia is a three year project with partners:

  • University of Newcastle (UK)
  • Universidade de Lisboa (P)
  • DERA, Malvern (UK)
  • Saarland University (D)
  • LAAS-CNRS, Toulouse (F)
  • IBM, Zurich (CH)
slide-4
SLIDE 4

10

What is Intrusion Detection?

Intrusion Detection concerns the set of practices and mechanisms used towards detecting security errors and failures and diagnosing intrusions and attacks. That is to say that ID is error detection and fault diagnosis with respect to a malicious fault model.

slide-5
SLIDE 5

12

IDS and MAFTIA

Three addressed views of IDS and MAFTIA:

  • How does the Intrusion Detection System help provide

dependability for the entire system? √

  • How does one build a dependable Intrusion Detection

System?

  • Do the other dependable components help for the In-

trusion Detection System? ×

slide-6
SLIDE 6

21

Fault Injection

Target Coarse scale attacks Accidental misconfiguration Fault Injection against Sensor Engine Attack IDS Analysis Indications

slide-7
SLIDE 7

22

Redundant Monitoring

B−Sensor Target A−Sensor A−Sensor Activity Analysis

slide-8
SLIDE 8

23

Differential Observation

Compare snap shots Of networks and machines

  • NSA
  • nmap
  • Tripwire
slide-9
SLIDE 9

25

Integration with Security Scanners

Integrate IDS with security scanner towards

  • Reduction of false positives
  • Greater context for true positives
  • Fault injection √
  • Differential observation √
slide-10
SLIDE 10

17

Channels

Sender Receiver Sender Receiver Sender Receiver Sender Receiver Filter

slide-11
SLIDE 11

18

Channels

May be subject to event:

  • Deletion
  • Insertion
  • Alteration

We need integrity, authenticity, QoS, and liveness.

slide-12
SLIDE 12

19

Channels

So we can add to an event stream {Ei}:

  • Hash chaining

Ci = H(Ci−1, Ei)

  • Authentication codes

Ci = H(S, Ci−1, Ei)

  • Heart beat

do {sleep 60; log "beep";}

slide-13
SLIDE 13

26

Conclusion

Dependability methods provide valuable insights into effective Intrusion Detection