Computer amp; Network Security - Welcome to University of 计算机amp；网络安全-大学欢迎您.docVIP

Intro to Network Security Intrusion Detection Systems Text: Network Security: The Complete Reference, Bragg, Rhodes-Ousley, Strassberg et al. Chapter 14 Objectives: The student should be able to: Define how a signature-based, anomaly-based, and rule-based IDS works. Define stealth mode for a NIDS. Define false positives, false negatives, and how both affect the sensitivity of an IDS. Describe the difference between an IDS and IPS and the advantages/disadvantages of each. Describe when you would use a host IDS and/or a network IDS and some advantages of each. Describe functions of different Host IDS systems: System integrity verifiers, statistics monitors, deception systems, and configuration auditors. Draw the internal configuration of a tap, and describe how a switch SPAN port works. Describe the three responses that CISCO IDS’s can support in response to an attack. Describe the capabilities and cost of Snort, including its features, its programmability, its configurability, and its directory structure. Class Time: Lecture – Intro 1 hour Lecture – NIDS 1 hour Lab 1 hour Total: 3 hours Intrusion Detection Systems Intrusion Detection Systems (IDS): Security violation detector raises alarm when violation occurs. Attacks come from Inside: Unintentional (e.g., virus on floppy or misuse causes crash) or Deliberate Outside: Internet – script kiddies and knowledgeable hackers Firewalls only protect against outside Types of attacks IDS try to catch Protocol attacks: E.g., Flag exploits, fragmentation attacks Attempts at impersonation Password cracking Buffer overflows software vulnerability exploits Rootkit installation Rogue commands Malicious code: viruses, worms, Trojans Unauthorized file access/modification Denial of Service Signature- versus Anomaly-Based IDS Signature-based: Looks for attack signatures in packets or logs Retains signatures in a signature database or rule set(s). Can create custom rules – sometimes with wildcards Benefits Limitatio