NIST SP800-94：入侵检测与预防系统指南

需积分: 9 12 浏览量更新于2024-07-16 收藏 1.01MB PDF 举报

"NIST SP800-94.pdf" 是一份由美国国家标准与技术研究所（NIST）发布的关于入侵检测系统（IDS）和入侵预防系统（IPS）的专业指南。这份指南旨在帮助组织理解并有效地设计、实施、配置、保护、监控和维护入侵检测和预防系统（IDPS）。它涵盖了四种类型的IDPS产品：基于网络的、无线的、网络行为分析的和基于主机的，并介绍了与之相辅相成的技术，如安全信息和事件管理软件以及网络取证分析工具。尽管主要关注企业级IDPS解决方案，但其中的许多信息也适用于独立和小型规模的IDPS部署。该文档详细讨论了IDS和IPS的关键概念和技术，这两种系统在网络安全中的作用是识别和防止未经授权的活动，从而保护组织免受恶意攻击和数据泄露。IDS侧重于检测潜在威胁，而IPS则进一步增加了阻止这些威胁的能力。NIST SP800-94提供了实际操作的建议，涵盖了系统选型、部署、性能优化和持续监控等多个方面。在选择和部署IDPS时，组织需要考虑各种因素，包括系统性能、可扩展性、误报率、对网络流量的影响以及与其他安全系统的集成。网络行为分析系统通过监测正常行为模式来识别异常，而基于主机的IDPS则专注于单个设备的安全。无线IDPS则专门针对无线网络环境中的安全挑战。文档还提到了安全信息和事件管理（SIEM）软件，它能够集中收集和分析来自多个源的安全事件，帮助快速响应潜在威胁。网络取证分析工具则用于收集和分析网络活动记录，以便在发生安全事件后进行详细调查。 NIST SP800-94强调了持续监控和更新IDPS的重要性，因为威胁环境会不断变化。定期更新系统签名、策略和配置，以及进行性能评估和测试，都是确保IDPS有效性的重要步骤。此外，文档还可能涉及合规性和法规要求，因为许多行业都有强制性的安全标准和规定。 NIST SP800-94为组织提供了一套全面的框架，以构建和维护强大的IDPS，以抵御日益复杂的网络威胁。这份出版物取代了之前的NIST SP800-31，反映了当前网络安全环境的变化和技术的进步。对于任何负责组织网络安全的IT专业人员来说，这是一份宝贵的资源。

GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS)

In addition to identifying incidents and supporting incident response efforts, organizations have found

other uses for IDPSs, including the following:

 Identifying security policy problems. An IDPS can provide some degree of quality control for

security policy implementation, such as duplicating firewall rulesets and alerting when it sees

network traffic that should have been blocked by the firewall but was not because of a firewall

configuration error.

 Documenting the existing threat to an organization. IDPSs log information about the threats that

they detect. Understanding the frequency and characteristics of attacks against an organization’s

computing resources is helpful in identifying the appropriate security measures for protecting the

resources. The information can also be used to educate management about the threats that the

organization faces.

 Deterring individuals from violating security policies. If individuals are aware that their actions

are being monitored by IDPS technologies for security policy violations, they may be less likely to

commit such violations because of the risk of detection.

Because of the increasing dependence on information systems and the prevalence and potential impact of

intrusions against those systems, IDPSs have become a necessary addition to the security infrastructure of

nearly every organization.

2.2 Key Functions of IDPS Technologies

There are many types of IDPS technologies, which are differentiated primarily by the types of events that

they can recognize and the methodologies that they use to identify incidents. In addition to monitoring

and analyzing events to identify undesirable activity, all types of IDPS technologies typically perform the

following functions:

 Recording information related to observed events. Information is usually recorded locally, and

might also be sent to separate systems such as centralized logging servers, security information and

event management (SIEM) solutions, and enterprise management systems.

 Notifying security administrators of important observed events. This notification, known as an

alert, occurs through any of several methods, including the following: e-mails, pages, messages on

the IDPS user interface, Simple Network Management Protocol (SNMP) traps, syslog messages, and

user-defined programs and scripts. A notification message typically includes only basic information

regarding an event; administrators need to access the IDPS for additional information.

 Producing reports. Reports summarize the monitored events or provide details on particular events

of interest.

Some IDPSs are also able to change their security profile when a new threat is detected. For example, an

IDPS might be able to collect more detailed information for a particular session after malicious activity is

detected within that session. An IDPS might also alter the settings for when certain alerts are triggered or

what priority should be assigned to subsequent alerts after a particular threat is detected.

IPS technologies are differentiated from IDS technologies by one characteristic: IPS technologies can

respond to a detected threat by attempting to prevent it from succeeding. They use several response

techniques, which can be divided into the following groups:

 The IPS stops the attack itself. Examples of how this could be done are as follows:

2-2

GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS)

– Terminate the network connection or user session that is being used for the attack

– Block access to the target (or possibly other likely targets) from the offending user account, IP

address, or other attacker attribute

– Block all access to the targeted host, service, application, or other resource.

 The IPS changes the security environment. The IPS could change the configuration of other

security controls to disrupt an attack. Common examples are reconfiguring a network device (e.g.,

firewall, router, switch) to block access from the attacker or to the target, and altering a host-based

firewall on a target to block incoming attacks. Some IPSs can even cause patches to be applied to a

host if the IPS detects that the host has vulnerabilities.

 The IPS changes the attack’s content. Some IPS technologies can remove or replace malicious

portions of an attack to make it benign. A simple example is an IPS removing an infected file

attachment from an e-mail and then permitting the cleaned email to reach its recipient. A more

complex example is an IPS that acts as a proxy and normalizes incoming requests, which means that

the proxy repackages the payloads of the requests, discarding header information. This might cause

certain attacks to be discarded as part of the normalization process.

Another common attribute of IDPS technologies is that they cannot provide completely accurate

detection. When an IDPS incorrectly identifies benign activity as being malicious, a false positive has

occurred. When an IDPS fails to identify malicious activity, a false negative has occurred. It is not

possible to eliminate all false positives and negatives; in most cases, reducing the occurrences of one

increases the occurrences of the other. Many organizations choose to decrease false negatives at the cost

of increasing false positives, which means that more malicious events are detected but more analysis

resources are needed to differentiate false positives from true malicious events. Altering the

configuration of an IDPS to improve its detection accuracy is known as tuning.

Most IDPS technologies also offer features that compensate for the use of common evasion techniques.

Evasion is modifying the format or timing of malicious activity so that its appearance changes but its

effect is the same. Attackers use evasion techniques to try to prevent IDPS technologies from detecting

their attacks. For example, an attacker could encode text characters in a particular way, knowing that the

target understands the encoding and hoping that any monitoring IDPSs do not. Most IDPS technologies

can overcome common evasion techniques by duplicating special processing performed by the targets. If

the IDPS can “see” the activity in the same way that the target would, then evasion techniques will

generally be unsuccessful at hiding attacks.

2.3 Common Detection Methodologies

IDPS technologies use many methodologies to detect incidents. Sections 2.3.1 through 2.3.3 discuss the

primary classes of detection methodologies: signature-based, anomaly-based, and stateful protocol

analysis, respectively. Most IDPS technologies use multiple detection methodologies, either separately or

integrated, to provide more broad and accurate detection.

2-3

GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS)

2.3.1 Signature-Based Detection

A signature is a pattern that corresponds to a known threat. Signature-based detection is the process of

comparing signatures against observed events to identify possible incidents.

Examples of signatures are

as follows:

 A telnet attempt with a username of “root”, which is a violation of an organization’s security policy

 An e-mail with a subject of “Free pictures!” and an attachment filename of “freepics.exe”, which are

characteristics of a known form of malware

 An operating system log entry with a status code value of 645, which indicates that the host’s auditing

has been disabled.

Signature-based detection is very effective at detecting known threats but largely ineffective at detecting

previously unknown threats, threats disguised by the use of evasion techniques, and many variants of

known threats. For example, if an attacker modified the malware in the previous example to use a

filename of “freepics2.exe”, a signature looking for “freepics.exe” would not match it.

Signature-based detection is the simplest detection method because it just compares the current unit of

activity, such as a packet or a log entry, to a list of signatures using string comparison operations.

Signature-based detection technologies have little understanding of many network or application

protocols and cannot track and understand the state of complex communications. For example, they

cannot pair a request with the corresponding response, such as knowing that a request to a Web server for

a particular page generated a response status code of 403, meaning that the server refused to fill the

request. They also lack the ability to remember previous requests when processing the current request.

This limitation prevents signature-based detection methods from detecting attacks that comprise multiple

events if none of the events contains a clear indication of an attack.

2.3.2 Anomaly-Based Detection

Anomaly-based detection is the process of comparing definitions of what activity is considered normal

against observed events to identify significant deviations. An IDPS using anomaly-based detection has

profiles that represent the normal behavior of such things as users, hosts, network connections, or

applications. The profiles are developed by monitoring the characteristics of typical activity over a period

of time. For example, a profile for a network might show that Web activity comprises an average of 13%

of network bandwidth at the Internet border during typical workday hours. The IDPS then uses statistical

methods to compare the characteristics of current activity to thresholds related to the profile, such as

detecting when Web activity comprises significantly more bandwidth than expected and alerting an

administrator of the anomaly. Profiles can be developed for many behavioral attributes, such as the

number of e-mails sent by a user, the number of failed login attempts for a host, and the level of processor

usage for a host in a given period of time.

The major benefit of anomaly-based detection methods is that they can be very effective at detecting

previously unknown threats. For example, suppose that a computer becomes infected with a new type of

malware. The malware could consume the computer’s processing resources, send large numbers of e-

Signature-based detection is sometimes referred to as misuse detection, but this publication does not use that term because it

implies that misuse is only detected using signatures, which is not true. Also, signature-based detection is considered by

some parties to include stateful protocol analysis, as described in Section 2.3.3. For the purposes of this publication,

signature-based detection is defined so as not to include stateful protocol analysis, but other publications may have different

definitions.

2-4

GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS)

mails, initiate large numbers of network connections, and perform other behavior that would be

significantly different from the established profiles for the computer.

An initial profile is generated over a period of time (typically days, sometimes weeks) sometimes called a

training period. Profiles for anomaly-based detection can either be static or dynamic. Once generated, a

static profile is unchanged unless the IDPS is specifically directed to generate a new profile. A dynamic

profile is adjusted constantly as additional events are observed. Because systems and networks change

over time, the corresponding measures of normal behavior also change; a static profile will eventually

become inaccurate, so it needs to be regenerated periodically. Dynamic profiles do not have this problem,

but they are susceptible to evasion attempts from attackers. For example, an attacker can perform small

amounts of malicious activity occasionally, then slowly increase the frequency and quantity of activity. If

the rate of change is sufficiently slow, the IDPS might think the malicious activity is normal behavior and

include it in its profile. Malicious activity might also be observed by an IDPS while it builds its initial

profiles.

Inadvertently including malicious activity as part of a profile is a common problem with anomaly-based

IDPS products. (In some cases, administrators can modify the profile to exclude activity in the profile

that is known to be malicious.) Another problem with building profiles is that it can be very challenging

in some cases to make them accurate, because computing activity can be so complex. For example, if a

particular maintenance activity that performs large file transfers occurs only once a month, it might not be

observed during the training period; when the maintenance occurs, it is likely to be considered a

significant deviation from the profile and trigger an alert. Anomaly-based IDPS products often produce

many false positives because of benign activity that deviates significantly from profiles, especially in

more diverse or dynamic environments. Another noteworthy problem with the use of anomaly-based

detection techniques is that it is often difficult for analysts to determine why a particular alert was

generated and to validate that an alert is accurate and not a false positive, because of the complexity of

events and number of events that may have caused the alert to be generated.

2.3.3 Stateful Protocol Analysis

Stateful protocol analysis is the process of comparing predetermined profiles of generally accepted

definitions of benign protocol activity for each protocol state against observed events to identify

deviations.

Unlike anomaly-based detection, which uses host or network-specific profiles, stateful

protocol analysis relies on vendor-developed universal profiles that specify how particular protocols

should and should not be used. The “stateful” in stateful protocol analysis means that the IDPS is capable

of understanding and tracking the state of network, transport, and application protocols that have a notion

of state. For example, when a user starts a File Transfer Protocol (FTP) session, the session is initially in

the unauthenticated state. Unauthenticated users should only perform a few commands in this state, such

as viewing help information or providing usernames and passwords. An important part of understanding

state is pairing requests with responses, so when an FTP authentication attempt occurs, the IDPS can

determine if it was successful by finding the status code in the corresponding response. Once the user has

authenticated successfully, the session is in the authenticated state, and users are expected to perform any

of several dozen commands. Performing most of these commands while in the unauthenticated state

would be considered suspicious, but in the authenticated state performing most of them is considered

benign.

Some vendors use the term “deep packet inspection” to refer to performing some type of stateful protocol analysis, often

combined with a firewall capability that can block communications determined to be malicious. This publication uses the

term “stateful protocol analysis” because it is appropriate for analyzing both network-based and host-based activity, whereas

“deep packet inspection” is an appropriate term for network-based activity only. Also, historically there has not been

consensus in the security community as to the meaning of “deep packet inspection”.

2-5

GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS)

Stateful protocol analysis can identify unexpected sequences of commands, such as issuing the same

command repeatedly or issuing a command without first issuing a command upon which it is dependent.

Another state tracking feature of stateful protocol analysis is that for protocols that perform

authentication, the IDPS can keep track of the authenticator used for each session, and record the

authenticator used for suspicious activity. This is helpful when investigating an incident. Some IDPSs

can also use the authenticator information to define acceptable activity differently for multiple classes of

users or specific users.

The “protocol analysis” performed by stateful protocol analysis methods usually includes reasonableness

checks for individual commands, such as minimum and maximum lengths for arguments. If a command

typically has a username argument, and usernames have a maximum length of 20 characters, then an

argument with a length of 1000 characters is suspicious. If the large argument contains binary data, then

it is even more suspicious.

Stateful protocol analysis methods use protocol models, which are typically based primarily on protocol

standards from software vendors and standards bodies (e.g., Internet Engineering Task Force [IETF]

Request for Comments [RFC]). The protocol models also typically take into account variances in each

protocol’s implementation. Many standards are not exhaustively complete in explaining the details of the

protocol, which causes variations among implementations. Also, many vendors either violate standards

or add proprietary features, some of which may replace features from the standards. For proprietary

protocols, complete details about the protocols are often not available, making it difficult for IDPS

technologies to perform comprehensive, accurate analysis. As protocols are revised and vendors alter

their protocol implementations, IDPS protocol models need to be updated to reflect those changes.

The primary drawback to stateful protocol analysis methods is that they are very resource-intensive

because of the complexity of the analysis and the overhead involved in performing state tracking for

many simultaneous sessions. Another serious problem is that stateful protocol analysis methods cannot

detect attacks that do not violate the characteristics of generally acceptable protocol behavior, such as

performing many benign actions in a short period of time to cause a denial of service. Yet another

problem is that the protocol model used by an IDPS might conflict with the way the protocol is

implemented in particular versions of specific applications and operating systems, or how different client

and server implementations of the protocol interact.

2.4 Types of IDPS Technologies

There are many types of IDPS technologies. For the purposes of this document, they are divided into the

following four groups based on the type of events that they monitor and the ways in which they are

deployed:

 Network-Based, which monitors network traffic for particular network segments or devices and

analyzes the network and application protocol activity to identify suspicious activity. It can identify

many different types of events of interest. It is most commonly deployed at a boundary between

networks, such as in proximity to border firewalls or routers, virtual private network (VPN) servers,

remote access servers, and wireless networks. Section 4 contains extensive information on network-

based IDPS technologies.

 Wireless, which monitors wireless network traffic and analyzes its wireless networking protocols to

identify suspicious activity involving the protocols themselves. It cannot identify suspicious activity

in the application or higher-layer network protocols (e.g., TCP, UDP) that the wireless network traffic

is transferring. It is most commonly deployed within range of an organization’s wireless network to

2-6

剩余126页未读，继续阅读

艾米的爸爸

粉丝: 760
资源: 314

NIST SP800-94：入侵检测与预防系统指南

NIST SP800-177r1.pdf

NIST SP800-30信息安全文档

NIST SP800-145.pdf

nist sp800-161下载

NIST SP800-90A

nist sp800-181

nist sp800-108

NIST SP800-131A

nist sp800-60

2017 nist sp800-181

最新资源