没有合适的资源?快使用搜索试试~ 我知道了~
首页NIST SP800-94:入侵检测与预防系统指南
"NIST SP800-94.pdf" 是一份由美国国家标准与技术研究所(NIST)发布的关于入侵检测系统(IDS)和入侵预防系统(IPS)的专业指南。这份指南旨在帮助组织理解并有效地设计、实施、配置、保护、监控和维护入侵检测和预防系统(IDPS)。它涵盖了四种类型的IDPS产品:基于网络的、无线的、网络行为分析的和基于主机的,并介绍了与之相辅相成的技术,如安全信息和事件管理软件以及网络取证分析工具。尽管主要关注企业级IDPS解决方案,但其中的许多信息也适用于独立和小型规模的IDPS部署。
该文档详细讨论了IDS和IPS的关键概念和技术,这两种系统在网络安全中的作用是识别和防止未经授权的活动,从而保护组织免受恶意攻击和数据泄露。IDS侧重于检测潜在威胁,而IPS则进一步增加了阻止这些威胁的能力。NIST SP800-94提供了实际操作的建议,涵盖了系统选型、部署、性能优化和持续监控等多个方面。
在选择和部署IDPS时,组织需要考虑各种因素,包括系统性能、可扩展性、误报率、对网络流量的影响以及与其他安全系统的集成。网络行为分析系统通过监测正常行为模式来识别异常,而基于主机的IDPS则专注于单个设备的安全。无线IDPS则专门针对无线网络环境中的安全挑战。
文档还提到了安全信息和事件管理(SIEM)软件,它能够集中收集和分析来自多个源的安全事件,帮助快速响应潜在威胁。网络取证分析工具则用于收集和分析网络活动记录,以便在发生安全事件后进行详细调查。
NIST SP800-94强调了持续监控和更新IDPS的重要性,因为威胁环境会不断变化。定期更新系统签名、策略和配置,以及进行性能评估和测试,都是确保IDPS有效性的重要步骤。此外,文档还可能涉及合规性和法规要求,因为许多行业都有强制性的安全标准和规定。
NIST SP800-94为组织提供了一套全面的框架,以构建和维护强大的IDPS,以抵御日益复杂的网络威胁。这份出版物取代了之前的NIST SP800-31,反映了当前网络安全环境的变化和技术的进步。对于任何负责组织网络安全的IT专业人员来说,这是一份宝贵的资源。
![](https://csdnimg.cn/release/download_crawler_static/12177885/bg10.jpg)
GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS)
In addition to identifying incidents and supporting incident response efforts, organizations have found
other uses for IDPSs, including the following:
Identifying security policy problems. An IDPS can provide some degree of quality control for
security policy implementation, such as duplicating firewall rulesets and alerting when it sees
network traffic that should have been blocked by the firewall but was not because of a firewall
configuration error.
Documenting the existing threat to an organization. IDPSs log information about the threats that
they detect. Understanding the frequency and characteristics of attacks against an organization’s
computing resources is helpful in identifying the appropriate security measures for protecting the
resources. The information can also be used to educate management about the threats that the
organization faces.
Deterring individuals from violating security policies. If individuals are aware that their actions
are being monitored by IDPS technologies for security policy violations, they may be less likely to
commit such violations because of the risk of detection.
Because of the increasing dependence on information systems and the prevalence and potential impact of
intrusions against those systems, IDPSs have become a necessary addition to the security infrastructure of
nearly every organization.
2.2 Key Functions of IDPS Technologies
There are many types of IDPS technologies, which are differentiated primarily by the types of events that
they can recognize and the methodologies that they use to identify incidents. In addition to monitoring
and analyzing events to identify undesirable activity, all types of IDPS technologies typically perform the
following functions:
Recording information related to observed events. Information is usually recorded locally, and
might also be sent to separate systems such as centralized logging servers, security information and
event management (SIEM) solutions, and enterprise management systems.
Notifying security administrators of important observed events. This notification, known as an
alert, occurs through any of several methods, including the following: e-mails, pages, messages on
the IDPS user interface, Simple Network Management Protocol (SNMP) traps, syslog messages, and
user-defined programs and scripts. A notification message typically includes only basic information
regarding an event; administrators need to access the IDPS for additional information.
Producing reports. Reports summarize the monitored events or provide details on particular events
of interest.
Some IDPSs are also able to change their security profile when a new threat is detected. For example, an
IDPS might be able to collect more detailed information for a particular session after malicious activity is
detected within that session. An IDPS might also alter the settings for when certain alerts are triggered or
what priority should be assigned to subsequent alerts after a particular threat is detected.
IPS technologies are differentiated from IDS technologies by one characteristic: IPS technologies can
respond to a detected threat by attempting to prevent it from succeeding. They use several response
techniques, which can be divided into the following groups:
The IPS stops the attack itself. Examples of how this could be done are as follows:
2-2
![](https://csdnimg.cn/release/download_crawler_static/12177885/bg11.jpg)
GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS)
– Terminate the network connection or user session that is being used for the attack
– Block access to the target (or possibly other likely targets) from the offending user account, IP
address, or other attacker attribute
– Block all access to the targeted host, service, application, or other resource.
The IPS changes the security environment. The IPS could change the configuration of other
security controls to disrupt an attack. Common examples are reconfiguring a network device (e.g.,
firewall, router, switch) to block access from the attacker or to the target, and altering a host-based
firewall on a target to block incoming attacks. Some IPSs can even cause patches to be applied to a
host if the IPS detects that the host has vulnerabilities.
The IPS changes the attack’s content. Some IPS technologies can remove or replace malicious
portions of an attack to make it benign. A simple example is an IPS removing an infected file
attachment from an e-mail and then permitting the cleaned email to reach its recipient. A more
complex example is an IPS that acts as a proxy and normalizes incoming requests, which means that
the proxy repackages the payloads of the requests, discarding header information. This might cause
certain attacks to be discarded as part of the normalization process.
Another common attribute of IDPS technologies is that they cannot provide completely accurate
detection. When an IDPS incorrectly identifies benign activity as being malicious, a false positive has
occurred. When an IDPS fails to identify malicious activity, a false negative has occurred. It is not
possible to eliminate all false positives and negatives; in most cases, reducing the occurrences of one
increases the occurrences of the other. Many organizations choose to decrease false negatives at the cost
of increasing false positives, which means that more malicious events are detected but more analysis
resources are needed to differentiate false positives from true malicious events. Altering the
configuration of an IDPS to improve its detection accuracy is known as tuning.
Most IDPS technologies also offer features that compensate for the use of common evasion techniques.
Evasion is modifying the format or timing of malicious activity so that its appearance changes but its
effect is the same. Attackers use evasion techniques to try to prevent IDPS technologies from detecting
their attacks. For example, an attacker could encode text characters in a particular way, knowing that the
target understands the encoding and hoping that any monitoring IDPSs do not. Most IDPS technologies
can overcome common evasion techniques by duplicating special processing performed by the targets. If
the IDPS can “see” the activity in the same way that the target would, then evasion techniques will
generally be unsuccessful at hiding attacks.
2.3 Common Detection Methodologies
IDPS technologies use many methodologies to detect incidents. Sections 2.3.1 through 2.3.3 discuss the
primary classes of detection methodologies: signature-based, anomaly-based, and stateful protocol
analysis, respectively. Most IDPS technologies use multiple detection methodologies, either separately or
integrated, to provide more broad and accurate detection.
2-3
![](https://csdnimg.cn/release/download_crawler_static/12177885/bg12.jpg)
GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS)
2.3.1 Signature-Based Detection
A signature is a pattern that corresponds to a known threat. Signature-based detection is the process of
comparing signatures against observed events to identify possible incidents.
5
Examples of signatures are
as follows:
A telnet attempt with a username of “root”, which is a violation of an organization’s security policy
An e-mail with a subject of “Free pictures!” and an attachment filename of “freepics.exe”, which are
characteristics of a known form of malware
An operating system log entry with a status code value of 645, which indicates that the host’s auditing
has been disabled.
Signature-based detection is very effective at detecting known threats but largely ineffective at detecting
previously unknown threats, threats disguised by the use of evasion techniques, and many variants of
known threats. For example, if an attacker modified the malware in the previous example to use a
filename of “freepics2.exe”, a signature looking for “freepics.exe” would not match it.
Signature-based detection is the simplest detection method because it just compares the current unit of
activity, such as a packet or a log entry, to a list of signatures using string comparison operations.
Signature-based detection technologies have little understanding of many network or application
protocols and cannot track and understand the state of complex communications. For example, they
cannot pair a request with the corresponding response, such as knowing that a request to a Web server for
a particular page generated a response status code of 403, meaning that the server refused to fill the
request. They also lack the ability to remember previous requests when processing the current request.
This limitation prevents signature-based detection methods from detecting attacks that comprise multiple
events if none of the events contains a clear indication of an attack.
2.3.2 Anomaly-Based Detection
Anomaly-based detection is the process of comparing definitions of what activity is considered normal
against observed events to identify significant deviations. An IDPS using anomaly-based detection has
profiles that represent the normal behavior of such things as users, hosts, network connections, or
applications. The profiles are developed by monitoring the characteristics of typical activity over a period
of time. For example, a profile for a network might show that Web activity comprises an average of 13%
of network bandwidth at the Internet border during typical workday hours. The IDPS then uses statistical
methods to compare the characteristics of current activity to thresholds related to the profile, such as
detecting when Web activity comprises significantly more bandwidth than expected and alerting an
administrator of the anomaly. Profiles can be developed for many behavioral attributes, such as the
number of e-mails sent by a user, the number of failed login attempts for a host, and the level of processor
usage for a host in a given period of time.
The major benefit of anomaly-based detection methods is that they can be very effective at detecting
previously unknown threats. For example, suppose that a computer becomes infected with a new type of
malware. The malware could consume the computer’s processing resources, send large numbers of e-
5
Signature-based detection is sometimes referred to as misuse detection, but this publication does not use that term because it
implies that misuse is only detected using signatures, which is not true. Also, signature-based detection is considered by
some parties to include stateful protocol analysis, as described in Section 2.3.3. For the purposes of this publication,
signature-based detection is defined so as not to include stateful protocol analysis, but other publications may have different
definitions.
2-4
![](https://csdnimg.cn/release/download_crawler_static/12177885/bg13.jpg)
GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS)
mails, initiate large numbers of network connections, and perform other behavior that would be
significantly different from the established profiles for the computer.
An initial profile is generated over a period of time (typically days, sometimes weeks) sometimes called a
training period. Profiles for anomaly-based detection can either be static or dynamic. Once generated, a
static profile is unchanged unless the IDPS is specifically directed to generate a new profile. A dynamic
profile is adjusted constantly as additional events are observed. Because systems and networks change
over time, the corresponding measures of normal behavior also change; a static profile will eventually
become inaccurate, so it needs to be regenerated periodically. Dynamic profiles do not have this problem,
but they are susceptible to evasion attempts from attackers. For example, an attacker can perform small
amounts of malicious activity occasionally, then slowly increase the frequency and quantity of activity. If
the rate of change is sufficiently slow, the IDPS might think the malicious activity is normal behavior and
include it in its profile. Malicious activity might also be observed by an IDPS while it builds its initial
profiles.
Inadvertently including malicious activity as part of a profile is a common problem with anomaly-based
IDPS products. (In some cases, administrators can modify the profile to exclude activity in the profile
that is known to be malicious.) Another problem with building profiles is that it can be very challenging
in some cases to make them accurate, because computing activity can be so complex. For example, if a
particular maintenance activity that performs large file transfers occurs only once a month, it might not be
observed during the training period; when the maintenance occurs, it is likely to be considered a
significant deviation from the profile and trigger an alert. Anomaly-based IDPS products often produce
many false positives because of benign activity that deviates significantly from profiles, especially in
more diverse or dynamic environments. Another noteworthy problem with the use of anomaly-based
detection techniques is that it is often difficult for analysts to determine why a particular alert was
generated and to validate that an alert is accurate and not a false positive, because of the complexity of
events and number of events that may have caused the alert to be generated.
2.3.3 Stateful Protocol Analysis
Stateful protocol analysis is the process of comparing predetermined profiles of generally accepted
definitions of benign protocol activity for each protocol state against observed events to identify
deviations.
6
Unlike anomaly-based detection, which uses host or network-specific profiles, stateful
protocol analysis relies on vendor-developed universal profiles that specify how particular protocols
should and should not be used. The “stateful” in stateful protocol analysis means that the IDPS is capable
of understanding and tracking the state of network, transport, and application protocols that have a notion
of state. For example, when a user starts a File Transfer Protocol (FTP) session, the session is initially in
the unauthenticated state. Unauthenticated users should only perform a few commands in this state, such
as viewing help information or providing usernames and passwords. An important part of understanding
state is pairing requests with responses, so when an FTP authentication attempt occurs, the IDPS can
determine if it was successful by finding the status code in the corresponding response. Once the user has
authenticated successfully, the session is in the authenticated state, and users are expected to perform any
of several dozen commands. Performing most of these commands while in the unauthenticated state
would be considered suspicious, but in the authenticated state performing most of them is considered
benign.
6
Some vendors use the term “deep packet inspection” to refer to performing some type of stateful protocol analysis, often
combined with a firewall capability that can block communications determined to be malicious. This publication uses the
term “stateful protocol analysis” because it is appropriate for analyzing both network-based and host-based activity, whereas
“deep packet inspection” is an appropriate term for network-based activity only. Also, historically there has not been
consensus in the security community as to the meaning of “deep packet inspection”.
2-5
![](https://csdnimg.cn/release/download_crawler_static/12177885/bg14.jpg)
GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS)
Stateful protocol analysis can identify unexpected sequences of commands, such as issuing the same
command repeatedly or issuing a command without first issuing a command upon which it is dependent.
Another state tracking feature of stateful protocol analysis is that for protocols that perform
authentication, the IDPS can keep track of the authenticator used for each session, and record the
authenticator used for suspicious activity. This is helpful when investigating an incident. Some IDPSs
can also use the authenticator information to define acceptable activity differently for multiple classes of
users or specific users.
The “protocol analysis” performed by stateful protocol analysis methods usually includes reasonableness
checks for individual commands, such as minimum and maximum lengths for arguments. If a command
typically has a username argument, and usernames have a maximum length of 20 characters, then an
argument with a length of 1000 characters is suspicious. If the large argument contains binary data, then
it is even more suspicious.
Stateful protocol analysis methods use protocol models, which are typically based primarily on protocol
standards from software vendors and standards bodies (e.g., Internet Engineering Task Force [IETF]
Request for Comments [RFC]). The protocol models also typically take into account variances in each
protocol’s implementation. Many standards are not exhaustively complete in explaining the details of the
protocol, which causes variations among implementations. Also, many vendors either violate standards
or add proprietary features, some of which may replace features from the standards. For proprietary
protocols, complete details about the protocols are often not available, making it difficult for IDPS
technologies to perform comprehensive, accurate analysis. As protocols are revised and vendors alter
their protocol implementations, IDPS protocol models need to be updated to reflect those changes.
The primary drawback to stateful protocol analysis methods is that they are very resource-intensive
because of the complexity of the analysis and the overhead involved in performing state tracking for
many simultaneous sessions. Another serious problem is that stateful protocol analysis methods cannot
detect attacks that do not violate the characteristics of generally acceptable protocol behavior, such as
performing many benign actions in a short period of time to cause a denial of service. Yet another
problem is that the protocol model used by an IDPS might conflict with the way the protocol is
implemented in particular versions of specific applications and operating systems, or how different client
and server implementations of the protocol interact.
2.4 Types of IDPS Technologies
There are many types of IDPS technologies. For the purposes of this document, they are divided into the
following four groups based on the type of events that they monitor and the ways in which they are
deployed:
Network-Based, which monitors network traffic for particular network segments or devices and
analyzes the network and application protocol activity to identify suspicious activity. It can identify
many different types of events of interest. It is most commonly deployed at a boundary between
networks, such as in proximity to border firewalls or routers, virtual private network (VPN) servers,
remote access servers, and wireless networks. Section 4 contains extensive information on network-
based IDPS technologies.
Wireless, which monitors wireless network traffic and analyzes its wireless networking protocols to
identify suspicious activity involving the protocols themselves. It cannot identify suspicious activity
in the application or higher-layer network protocols (e.g., TCP, UDP) that the wireless network traffic
is transferring. It is most commonly deployed within range of an organization’s wireless network to
2-6
剩余126页未读,继续阅读
2020-02-25 上传
2023-09-16 上传
2024-02-19 上传
2023-04-30 上传
2024-02-03 上传
2023-11-24 上传
2023-08-01 上传
![](https://profile-avatar.csdnimg.cn/83238073b72f4329a312d208e1a70521_samsho2.jpg!1)
艾米的爸爸
- 粉丝: 760
- 资源: 314
上传资源 快速赚钱
我的内容管理 展开
我的资源 快来上传第一个资源
我的收益
登录查看自己的收益我的积分 登录查看自己的积分
我的C币 登录后查看C币余额
我的收藏
我的下载
下载帮助
![](https://csdnimg.cn/release/wenkucmsfe/public/img/voice.245cc511.png)
最新资源
- AirKiss技术详解:无线传递信息与智能家居连接
- Hibernate主键生成策略详解
- 操作系统实验:位示图法管理磁盘空闲空间
- JSON详解:数据交换的主流格式
- Win7安装Ubuntu双系统详细指南
- FPGA内部结构与工作原理探索
- 信用评分模型解析:WOE、IV与ROC
- 使用LVS+Keepalived构建高可用负载均衡集群
- 微信小程序驱动餐饮与服装业创新转型:便捷管理与低成本优势
- 机器学习入门指南:从基础到进阶
- 解决Win7 IIS配置错误500.22与0x80070032
- SQL-DFS:优化HDFS小文件存储的解决方案
- Hadoop、Hbase、Spark环境部署与主机配置详解
- Kisso:加密会话Cookie实现的单点登录SSO
- OpenCV读取与拼接多幅图像教程
- QT实战:轻松生成与解析JSON数据
安全验证
文档复制为VIP权益,开通VIP直接复制
![](https://csdnimg.cn/release/wenkucmsfe/public/img/green-success.6a4acb44.png)