RE: Current state of Anomaly-based Intrusion Detection

["Gunnoe, Jason" <Jason.Gunnoe () thomson com>]

I would have to agree.  Regardless of the newest buzz-word or appliance what I am interested is actionable 
intelligence.  Not necessarily spikes, valley's, protocol anomalies etc...

I want what matters.  Typically, that means maintaining the integrity or availability of a given system, and sometimes, 
but not as often, re-assuring management that sensitive information assets are safe.

If I see a spike or an "event", and after investigation it results in a "non-event", I've wasted my time and possibly 
someone else's.

That's why I think that SourceFire's RNA is headed down the correct IDS/IPS (IPS -- blah, there is a whole different 
discussion) path.  In essence, without CONTEXT, traffic patterns and host chatter means absolutely nothing.  The 
question remains for this product or p0f/nessus/Qualys/ISS integration etc... is: Are they ready to fingerprint every 
asset on every network at the enterprise scale.  When your network nodes range in the 20,000 across the world, using 
several networking technologies with support in multiple languages...

You get where I'm going.

I have seen large ISP's implement anomaly technologies on internet backbones, but typically, they are only useful for 
identifying large scale malware disruptions before they happen.  They always give the slammer example, which is what, 4 
years old now...

Jason Gunnoe CISSP, RHCE
Information Security
Thomson Learning   

-----Original Message-----
From: Andrew Plato [mailto:andrew.plato () anitian com] 
Sent: Monday, February 28, 2005 11:56 AM
To: Göran Sandahl; focus-ids () lists securityfocus com
Subject: RE: Current state of Anomaly-based Intrusion Detection

This all depends on your definition of an "anomaly" detection engine. I would say that anything that establishes 
"norms" for protocols or traffic is, in essence, an anomaly detection system. It is comparing what it sees to 
established norms. This would therefore include most of the popular IDS/IPSs on the market. Many of the commercial 
IPS/IDS establish norms for each application protocol (such as a User ID field shouldn't be more than 150 bytes). Then 
when there is a violation of that norm, its considered an "anomaly." 

One of the painful lessons I have learned in the past 6 years of installing and tuning IPS and IDS is that most 
networks are a hodge podge of "anomalies."  Averaging traffic doesn't work because businesses often have spikes and 
valleys in traffic. Detecting protocol anomalies is a mess as many applications do not use network and application 
protocols properly. SNMP comes to mind. This is a protocol that is grotesquely misused. 

As such, there really is no perfect system. People on all sides will scream and howl how their system is superior and 
can see through walls and bend space-time to detect the hackers. The reality is, most of the IPS/IDS on the market have 
a variety of weaknesses. 

Pure signature-based IPS/IDS may be making a comeback. This is partially because the hardware has now progressed to a 
point where signature-based systems can process packets and streams quickly enough not to cause significant latency. I 
have been spending a lot of time with TippingPoint's UnityOne product these days and their engine is interesting in 
that way. While it can do a lot of protocol anomaly checking, it does not bother alerting on those (by default.) They 
have speeded up the signature engine to the point where they can pick out known bad stuff and limit the protocol 
anomaly noise. This dramatically limits their false positive rate. 

Network intrusion detection isn't really that new. Its been around for a decade or more. Anomaly detection isn't really 
new either. Its been around for 5-6 years. I think what is new is the expectations for IPS/IDS. The technology has 
evolved to a point where being able to detect every weird variance in a network might not be as useful as originally 
thought. 

Andrew Plato, CISSP
President 
Anitian Enterprise Security
www.anitian.com 



 

-----Original Message-----
From: Göran Sandahl [mailto:goran () gsandahl net] 
Sent: Friday, February 25, 2005 4:05 PM
To: focus-ids () lists securityfocus com
Subject: Current state of Anomaly-based Intrusion Detection

Hi all.

I'm trying to get a picture of the current state of Anomaly-based network-monitoring-systems. In other words, 
Anomaly-based IDSs (are they really called ADSs?). 
After following the thread "Specification-based Anomaly Detection", I've realised that this question probably has allot 
of answers. However, I'd be very glad if you would take the time and write a couple of lines on what you think of the 
techniques that are used today, and whats needed for the future. 
I'm interested in "both sides of the story", so please tense your muscles and raise your voice ;)

As i figured, there are two different techniques that these systems work upon. 
Either, they are based on specifications (for example, hardcoded 200kb/s SMTP-traffic is normal) , or on statistic 
(Based on an "average". For example, 20 current TCP-sessions is normal). How does these techniques really work? How are 
they implemented today? How is this statistical information usually gathered? 

Also, signature-based IDSs are vulnerable to false alerts of different kinds (postitive, negative etc). I can imagine 
that anomaly-based techniques might suffer even worse to this. True?

And finally, while "reading through the lines" on some of the posts to the thread mentioned above, I got a feeling that 
this technique isn't yet ready for prime-time yet. Why is this? As I figure, the whole idea with network intrusion 
detection is pretty new, and none of the techniques seems to be without flaws.

Thanks in advance
Cheers
Göran

--

Göran Sandahl
mail:        goran () gsandahl net
web:         http://gsandahl.net

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------




--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------



--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------