Intrusion detection systems (IDSs) help detect attacks on systems and networks. If you’re planning on taking the Security+ exam, you should have a basic understanding of the two primary detection methods.
For example, can you answer this question?
Q. A HIDS reported a vulnerability on a system using an assigned vulnerability identification number. After researching the number on the vendor’s web site, you identify the recommended solution and begin applying it. What type of HIDS is in use?
A. Network-based
B. Signature-based
C. Heuristic-based
D. Anomaly-based
More, do you know why the correct answer is correct and the incorrect answers are incorrect? The answer and explanation is available at the end of this post.
Detection Methods
An IDS can only detect an attack. It cannot prevent attacks. In contrast, an IPS prevents attacks by detecting them and stopping them before they reach the target. An attack is any attempt to compromise confidentiality, integrity, or availability.
The two primary methods of detection are signature-based and anomaly-based. Any type of IDS (HIDS or NIDS) can detect attacks based on signatures, anomalies, or both. The HIDS monitors the network traffic reaching its NIC, and the NIDS monitors the traffic on the network.
Signature-Based Detection
Signature-based IDSs (also called definition-based) use a database of known vulnerabilities or known attack patterns. For example, tools are available for an attacker to launch a SYN flood attack on a server by simply entering the IP address of the system to attack. The attack tool then floods the target system with synchronize (SYN) packets, but never completes the three-way Transmission Control Protocol (TCP) handshake with the final acknowledge (ACK) packet. If the attack isn’t blocked, it can consume resources on a system and ultimately cause it to crash.
However, this is a known attack with a specific pattern of successive SYN packets from one IP to another IP. The IDS can detect these patterns when the signature database includes the attack definitions. The process is very similar to what antivirus software uses to detect malware. You need to update both IDS signatures and antivirus definitions from the vendor on a regular basis to protect against current threats.
Chapter 8 of the CompTIA Security+: Get Certified Get Ahead: SY0-401 Study Guide covers vulnerability scanners in more depth. As an introduction, they can scan systems and networks for vulnerabilities and report issues. They often use vulnerabilities listed in the Common Vulnerabilities and Exposures (CVE) list, which is a dictionary of publicly known security vulnerabilities and exposures. Some IDS systems use the CVE list and its standardized numbering system when identifying and reporting on some issues.
For example, CVE-2014-3522 is a known vulnerability related to Apache servers running on Windows servers. Administrators can look up the number to identify the issue and the resolution. In this case, the resolution is to upgrade Apache to a newer version. You can look up any CVE item at https://cve.mitre.org/cve/cve.html.
Anomaly-Based Detection
Anomaly-based (also called heuristic-based or behavior-based) detection first identifies normal operation or normal behavior. It does this by creating a performance baseline under normal operating conditions.
The IDS provides continuous monitoring by constantly comparing current network behavior against the baseline. When the IDS detects abnormal activity (outside normal boundaries as identified in the baseline), it gives an alert indicating a potential attack.
Anomaly-based detection is similar to how heuristic-based antivirus software works. Although the internal methods are different, both examine activity and make decisions that are outside the scope of a signature or definition database.
This can be effective at discovering zero-day exploits. A zero-day vulnerability is usually defined as one that is unknown to the vendor. However, in some usage, administrators define a zero-day exploit as one where the vendor has not released a patch. In other words, the vendor may know about the vulnerability but has not written, tested, and released a patch to close the vulnerability yet.
In both cases, the vulnerability exists and systems are unprotected. If attackers discover the vulnerabilities, they try to exploit them. However, the attack has the potential to create abnormal traffic allowing an anomaly-based system to detect it.
Any time administrators make any significant changes to a system or network that cause the normal behavior to change, they should re-create the baseline. Otherwise, the IDS will constantly alert on what is now normal behavior.
Remember this
Signature-based detection identifies issues based on known attacks or vulnerabilities. Many IDSs use specific numbering systems that they’ve created or use the CVE list. Signature-based detection systems can detect known anomalies. Anomaly-based IDSs (also called behavior-based) can detect unknown anomalies. They start with a performance baseline of normal behavior and then compare network traffic against this baseline. When traffic differs significantly from the baseline, the IDS sends an alert.
Q. A HIDS reported a vulnerability on a system using an assigned vulnerability identification number. After researching the number on the vendor’s web site, you identify the recommended solution and begin applying it. What type of HIDS is in use?
A. Network-based
B. Signature-based
C. Heuristic-based
D. Anomaly-based
Answer is B. If the issue has an assigned number, it must be known, so it is signature-based.
A host-based intrusion detection system (HIDS) is not network-based.
A heuristic-based (or anomaly-based) detection system catches issues that are not previously known.
