UNIT IV

INTRUSION DETECTION

Host Based Intrusion Detection – Network Based Intrusion Detection – Distributed or Hybrid Intrusion
Detection – Intrusion Detection Exchange Format – Honeypots – Example System Snort.

Introduction

Intrusion is when an attacker gets unauthorized access to a device, network, or system. Cyber criminals
use advanced techniques to sneak into organizations without being detected.

Intrusion Detection System (IDS)

It observes network traffic for malicious transactions and sends immediate alerts when it is observed.

It is software that checks a network or system for malicious activities or policy violations.

Each illegal activity or violation is often recorded either centrally using an SIEM system or notified to an
administration.

IDS monitors a network or system for malicious activity and protects a computer network from
unauthorized access from users, including perhaps insiders.

The intrusion detector learning task is to build a predictive model (i.e. a classifier) capable of
distinguishing between ‘bad connections’ (intrusion/attacks) and ‘good (normal) connections’.

Comparison of IDS with Firewalls

IDS and firewall both are related to network security but an IDS differs from a firewall as a firewall looks
outwardly for intrusions in order to stop them from happening.

Firewalls restrict access between networks to prevent intrusion and if an attack is from inside the network
it doesn’t signal.

An IDS describes a suspected intrusion once it has happened and then signals an alarm.

94
 Fig 4.1 Intrusion Detection System

4.1 HOST INTRUSION DETECTION SYSTEM (HIDS)

Host intrusion detection systems (HIDS) run on independent hosts or devices on the network.

A HIDS monitors the incoming and outgoing packets from the device only and will alert the administrator
if suspicious or malicious activity is detected.

It takes a snapshot of existing system files and compares it with the previous snapshot. If the analytical
system files were edited or deleted, an alert is sent to the administrator to investigate.

Fig 4.2 Host Intrusion Detection System

95
An example of HIDS usage can be seen on mission-critical machines, which are not expected to change
their layout.

Advantages of HIDS

• Analyze what an application does.

• Detects the attacks excluded from the network

Disadvantage of HIDS

• Excluded from the network

• Needs to be installed on every host spot

• Passive in nature, so it just informs about the attack without doing anything about it.

4.2 NETWORK INTRUSION DETECTION SYSTEM (NIDS)

Network intrusion detection systems (NIDS) are set up at a planned point within the network to examine
traffic from all devices on the network.

It performs an observation of passing traffic on the entire subnet and matches the traffic that is passed
on the subnets to the collection of known attacks.

Once an attack is identified or abnormal behavior is observed, the alert can be sent to the administrator.

An example of a NIDS is installing it on the subnet where firewalls are located in order to see if
someone is trying to crack the firewall.

Fig 4.3 Network Based Intrusion Detection

96
Advantage of NID

• Detect attacks in the entire network

• It can use the information collected from attacks on different hosts to detect attacks on a new or fresh
host.

• Host production/performance remains unaffected.

Disadvantage of NID

• It might be slow as compared to the network speed.

• Scrutinizing protected channels may possess difficult.

• It is also passive in nature.

4.3 DISTRIBUTED OR HYBRID INTRUSION DETECTION

Hybrid intrusion detection system is made by the combination of two or more approaches to the
intrusion detection system. In the hybrid intrusion detection system, the host agent or system data is
combined with network information to develop a complete view of the network system.

The hybrid intrusion detection system is more effective in comparison to the other intrusion detection
system. Prelude is an example of Hybrid IDS.

Fig. 4.4 Distributed Or Hybrid Intrusion Detection

97
4.4 IDMEF (INTRUSION DETECTION MESSAGE EXCHANGE FORMAT)
It is a data format used to exchange information between software enabling intrusion detection,
intrusion prevention, security information collection and management systems that may need to
interact with them.

IDMEF messages are designed to be processed automatically. The details of the format are described
in the RFC 4765.

This RFC presents an implementation of the XML data model and the associated DTD. The
requirements for this format are described in RFC 4766, and the recommended transport protocol
(IDXP) is documented in RFC 4767.

Fig 4.5 Intrusion Detection Message Exchange Format

98
The purpose of IDMEF is to define data formats and exchange procedures for sharing information of
interest to intrusion detection and response systems and to the management systems that may need to
interact with them.

It is used in computer security for incidents reporting and exchanging. It is intended for easy automatic
processing.

IDMEF is a well-structured object-oriented format, which consists of 33 classes containing 108 fields,
including three mandatory:

• The classification

• The unique login

• The date of creation of the alert.

There are currently two types of IDMEF messages that can be created, Heartbeat or Alert

Heartbeat

The Heartbeats are sent by the analyzers to indicate their status.

These messages are sent at regular intervals which period is defined in the Heartbeat Interval Field.

If none of these messages are received for several periods of time, consider that this analyzer is not able
to trigger alerts.

Alert

Alerts are used to describe an attack that took place, the main areas that create the alert are:

• Create Time: Date of creation of the alert

• Detect Time: alert detection time by the analyzer

• Analyzer Time: The time the alert was sent by the analyzer

• Source: Details about the origin of the attack can be a service, a user, a process and / or a node

• Target: Details on the target of the attack can be a service, a user, a process and / or a node and a
file

• Classification: Name of the attack and references, as CVEs

• Assessment: Evaluation of the attack (severity, potential impact, etc.)

• Additional Data: Additional information on the attack

There are three other alert types that inherit from this scheme:

99
• Correlation Alert: Grouping of alerts related to one another

• Tool Alert: alerts from the same Grouping tool

1.5 HONEYPOTS

A Honeypot is a network-attached system used as a trap for cyber-attackers to detect and study the
tricks and types of attacks used by hackers.

It acts as a potential target on the internet and informs the defenders about any unauthorized attempt at
the information system.

Honeypots are mostly used by large companies and organizations involved in cybersecurity.

It helps cybersecurity researchers learn about the different types of attacks used by attackers.

It is suspected that even cybercriminals use these honeypots to decoy researchers and spread wrong
information.

The cost of a honeypot is generally high because it requires specialized skills and resources to implement
a system such that it appears to provide an organization’s resources while still preventing attacks at the
backend and access to any production system.

Honeypot in Cyber Security

A honeypot is a simulation of an IT system or software application that acts as bait to attract the attention
of attackers. While the honeypot appears to be a legitimate target, it is actually fake and carefully
monitored by an IT security team.

Fig 4.6 Honeypots

100
The term “honeypot” comes from the fact that this decoy serves as a “sweet” trap for attackers—recalling
the old proverb “You catch more flies with honey than with vinegar.”

Working of Honeypots

• Decoy Systems: Honeypots are carefully crafted to mimic real systems like servers, networks, or
databases, often with deliberately placed vulnerabilities to make them attractive targets.

• Attracting Attackers: Attackers, unaware they are targeting a decoy, will attempt to exploit these
vulnerabilities and gain access.

• Monitoring and Analysis: Once an attacker engages with the honeypot, every action, including their
IP address, tools, and commands executed, is logged and monitored. This data provides insights into
attack techniques and patterns.

• Data Collection and Analysis: Security teams analyze the collected data to understand attack
methods, identify vulnerabilities, and develop better defense strategies.

• Improving Security: The insights gathered from honeypots are used to enhance the security of real
systems, fix vulnerabilities, and update security controls.

Different Types of Honeypots

Honeypots come in many shapes and sizes, depending on the type of attack that IT teams are interested
in.

Below are just a few different types of honeypots you should know.

Email Traps

An email trap is a honeypot intended to collect spam and other malicious emails.

IT teams create a fake, publicly available email address, exposing it to cybercriminals.

The messages sent to this address can be immediately flagged as potential spam or malicious content.

Decoy Databases

A decoy database is a honeypot that offers fake information to attackers, luring and misleading them
during an attack.

While the contents of this decoy database may appear authentic, they are actually useless or even
harmful to the attacker.

The decoy serves as a distraction for attackers, preventing them from discovering real and valuable data.

101
Malware Honeypots

A malware honeypot is a decoy specifically intended to capture malicious software by imitating a

vulnerable system or network, such as a web server.

This type of honeypot has been set up with security flaws that are known to invite malware attacks. IT
teams can then analyze the malware to understand its behavior and identify its origins.

Spider Honeypots

A spider honeypot is a decoy designed for software that crawls the web, also known as “spiders.”

IT teams create fake websites or pages susceptible to Internet-based attacks, such as SQL injection and
cross-site scripting (XSS).

These flaws attract malicious robots that scan websites for vulnerabilities, looking for potential targets.

High-Interaction vs. Low-Interaction Honeypots

When it comes to honeypot security, one distinction is between high-interaction and low-interaction
honeypots:

• High-interaction honeypots are decoys of fully functional systems, completely mimicking a real IT
device or application.

As the name suggests, these honeypots let attackers interact with them as real entities, providing a full
range of privileges and access.

High-interaction honeypots let IT teams capture more information about attackers’ techniques but are
more complex to set up and maintain.

• Low-interaction honeypots are simulations of IT environments that only implement certain

applications or services, giving attackers only a limited set of interactions.

This means that low-interaction honeypots are easier to create, less resource-intensive, and less realistic
and informative.

Physical vs. Virtual Honeypots

Another key difference in the types of honeypots is the distinction between physical and virtual:

• A physical honeypot, as the name suggests, is a physical IT device or system connected to a

network with its own IP address.

Physical honeypots can achieve greater verisimilitude but are less frequently used due to the cost
involved.

102
• A virtual honeypot simulates an operating system or application hosted on a virtual machine.
Virtualization allows IT teams to quickly spin up and deploy new honeypots but does not allow
organizations to capture attacks that exploit physical vulnerabilities.

Advantages and Disadvantages of Honeypots

The advantages of using honeypots in cybersecurity include the following:

• Early detection of attacks: Honeypots can provide warning of new or previously unknown
cyberattacks, letting IT security teams respond more quickly and effectively.

• Wasted time and effort: Honeypots can cause attackers to waste time and effort on a decoy target,
distracting them from launching attacks on real IT systems.

The disadvantages of using honeypots in cybersecurity include the following:

• Attracting too much attention: If attackers realize that they have fallen victim to a honeypot, they
may seek to retaliate by continuing their assault on the organization’s legitimate targets.

• Resource-intensive: Honeypots require plenty of resources and expertise to set up properly, which
means their return on investment may be low.

Best Practices for Implementing Honeypots

When implementing honeypots, not all approaches are created equal. Below are some honeypot cyber
security best practices:

• Proper configuration and maintenance: Honeypots must be set up correctly and regularly
maintained to remain an attractive target for attackers.

• Integration with other security systems: Honeypots are most effective when integrating with other
IT security tools and practices.

• Regular monitoring: The IT security team needs to keep tabs on the honeypot to discover when an
attack is underway.

Real-World Applications of Honeypots

Honeypots are one of the most effective defenses that IT teams and organizations have against malicious
actors. Below are just a few real-world use cases of honeypots in cybersecurity:

• Government and military: Government and military institutions may use honeypots to distract
attackers from high-value targets. Honeypots can protect critical infrastructure such as power grids and
communication networks

103
• Financial industry: Financial companies are high-profile targets, which makes honeypots an
especially effective tactic for these businesses. Honeypots can be used to detect fraudulent financial
activity or attempts to steal customer data.

• Protecting intellectual property: Businesses that need to protect their IP can use honeypots to
distract and contain attackers.

1.6 SYSTEM SNORT

SNORT is a network based intrusion detection system which is written in C programming language.

It was developed in 1998 by Martin Roesch. Now it is developed by Cisco. It is free open-source software.
It can also be used as a packet sniffer to monitor the system in real time.

The network admin can use it to watch all the incoming packets and find the ones which are dangerous
to the system. It is based on library packet capture tool.

The rules are fairly easy to create and implement and it can be deployed in any kind of operating system
and any kind of network environment.

The main reason of the popularity of this IDS over others is that it is a free-to-use software and also open
source because of which any user can be able to use it as the way he wants.

Snort is an open source, highly configurable and portable host-based or network-based IDS. Snort is
referred to as a lightweight IDS, which has the following characteristics:

• Easily deployed on most nodes (host, server, router) of a network.

• Efficient operation that uses small amount of memory and processor time.
• Easily configured by system administrators who need to implement a specific security solution in
a short amount of time.
Snort can perform real-time packet capture, protocol analysis, and content searching and matching.
Snort is mainly designed to analyze TCP, UDP, and ICMP network protocols, though it can be extended
with plugins for other protocols. Snort can detect a variety of attacks and probes, based on a set of rules
configured by a system administrator.

Snort Architecture
A Snort installation consists of four logical components.

• Packet decoder
• Detection engine
• Logger
• Alerter

104
 Fig 4.7 Snort Architecture

A Snort implementation can be configured as a passive sensor, which monitors traffic but is not in the
main transmission path of the traffic, or an inline sensor, through which all packet traffic must pass. In
the latter case, Snort can perform intrusion prevention as well as intrusion detection.

Snort Rules
Snort uses a simple, flexible rule definition language that generates the rules used by the detection
engine. Al though the rules are simple and straightforward to write, they are powerful enough to
detect a wide variety of hostile or suspicious traffic.

Each rule consists of a fixed header and zero or more options (Figure 8.10). The
header has the following elements:

1. Action
2. Protocol
3. Source IP address
4. Source port
5. Direction
6. Destination IP address
7. Destination port

Fig 4.8 Snort rule formats

105
Snort Rule Actions

There are four major categories of rule options:

• Meta-data: Provide information about the rule but do not have any affect dur- ing detection.

• Payload: Look for data inside the packet payload and can be interrelated.

• Non-payload: Look for non-payload data.

• Post-detection: Rule-specific triggers that happen after a rule has matched a packet.

Features

• Real-time traffic monitor

• Packet logging

• Analysis of protocol

• Content matching

• OS fingerprinting

• Can be installed in any network environment.

• Creates logs

• Open Source

• Rules are easy to implement

Different SNORT Modes

1. Sniffer Mode

To print TCP/IP header use command ./snort -v

To print IP address along with header use command ./snort -vd
106
2. PacketLogging

To store packet in disk you need to give path where you want to store the logs. For this command
is./snort -dev -l ./SnortLogs.

3. Activate network intrusion detection mode

To start this mode use this command ./snort -dev -l ./SnortLogs -h [Link]/24 -c [Link]

Types of Rules in SNORT

There are 3 types of rules in SNORT, those are

1. Alert Rules: This uses the alert technique to produce notifications.

2. Logging Rules: It logs each individual alert as soon as it is generated.

3. Pass Rules: If the packet is deemed malicious, it is ignored and dropped.

Basic Usages

1. Packet Sniffing: The way traffic is being transmitted can be thoroughly examined by gathering the
individual packets that travel to and from devices on the network.

2. Generates Alerts: It generates warnings based on the configuration file's rules when it discovers
unusual or malicious activity, the possibility of a vulnerability being exploited, or a network threat that
compromises the organization's security policy.

3. Debug Traffic: After the traffic has been logged, any malicious packets and configuration problems
are checked.

107
 UNIT IV

PART -A

1. Which of the following is monitored by a Host-Based Intrusion Detection System (HIDS)?

A) Network traffic
B) File system changes and logs on a single host
C) External router configuration
D) Web application firewall
2. Network-Based Intrusion Detection Systems (NIDS) are primarily deployed at:
A) User desktops
B) Email servers
C) Network entry/exit points
D) Database systems
3. Which of the following is a limitation of HIDS?
A) Cannot detect internal threats
B) Monitors all traffic on the network
C) Limited to one host and cannot see network-wide attacks
D) Too expensive to deploy
4. Distributed Intrusion Detection Systems are designed to:
A) Detect only physical intrusions
B) Work independently without coordination
C) Collect and analyze data from multiple sources across a network
D) Replace antivirus software
5. A hybrid IDS combines features of:
A) Firewalls and antivirus
B) HIDS and NIDS
C) Cloud and edge computing
D) Authentication and encryption
6. The Intrusion Detection Message Exchange Format (IDMEF) is used to:
A) Encrypt data between two servers
B) Exchange information between IDS components in a standard format
C) Block unauthorized traffic
D) Install intrusion detection software
7. Which format does IDMEF use for data representation?
A) XML
B) JSON

108
 C) CSV
D) YAML
8. A Honeypot is mainly used to:
A) Block legitimate users
B) Confuse antivirus software
C) Attract and analyze attackers by acting as a decoy system
D) Speed up data transmission
9. Which of the following is NOT a type of honeypot?
A) Production honeypot
B) Research honeypot
C) Marketing honeypot
D) High-interaction honeypot
10. Snort is an example of a
A) Firewall
B) Packet sniffer
C) Network Intrusion Detection System (NIDS)
D) Virus scanner
11. Snort rules are written to
A) Scan local drives for viruses
B) Define how to detect specific attacks in network traffic
C) Format emails
D) Optimize web pages
12. Which language is primarily used to configure Snort rules?
A) Python
B) Bash
C) Snort Rule Language
D) SQL

PART – B

1. What does a Host-Based Intrusion Detection System (HIDS) monitor?

2. Differentiate between HIDS and NIDS.
3. Apply the concept of NIDS to monitor a university campus network.
4. Analyze the key differences between centralized and distributed intrusion detection systems.
5. Name any two types of honeypots.
6. What is the full form of IDMEF?
7. List two components of Snort.

109
8. Explain the role of a honeypot in cyber security.
9. Why is IDMEF important in intrusion detection systems?
10. What are honeypots, and how do they work? (Nov/Dec 2024)

PART C & D

1. Explain the key differences between HIDS and NIDS. Discuss their working principles, advantages, and
limitations in the context of enterprise network security.
2. Apply the concepts of hybrid intrusion detection to a hospital network system. Describe how HIDS, NIDS,
and honeypots can be deployed together to secure patient records and monitor suspicious activity.
3. Evaluate the features, advantages, and limitations of Snort as an open-source Intrusion Detection
System. Compare it with at least one commercial IDS solution in terms of efficiency, flexibility, and rule
management.
4. Define the following terms with examples:
• Host-Based Intrusion Detection System (HIDS)
• Network-Based Intrusion Detection System (NIDS)
• Honeypots
• Intrusion Detection Exchange Format (IDMEF)

5. Compare between host-based and network-based intrusion detection systems. (Nov/Dec 2024)
6. Analyse the importance of intrusion detection exchange formats in cybersecurity. (Nov/Dec 2024)

110