WIXLIB

can use the machine as a launchpad for di erent types of attacks.A Denial of Service (DoS) attack tries to exhaust the resources of a network or a system. An attack can be carried outby a few malformed packets that exploit vulnerabilities in thehost or by a vast number of legitimate packets that exhaust thevictim’s network bandwidth or resources (Bhattacharya et al.,2013). As a precursor, a distributed DoS attacker may accessmany machines to lunch a coordinated distributed DoS attack.A DoS attack causes frequent congestion, hindering legitimatecommunication.With the rapid emergence of external and internal threatsto networks and resources, we must think about security all thetime. As a result, researchers and practitioners have looked ata variety of approaches such as Intrusion Detection Systems(IDS), Intrusion Prevention Systems (IPS), Intrusion ResponseSystem (IRS) and Intrusion Tolerance System (ITS). IPS andIDS are important components of a layered security infrastructure.Four main steps (Bhattacharya et al., 2013) taken by an attacker prior to executing an intrusion into a network or systemare as follows.violations. Some systems or approaches may try to stop an intrusion attempt, but this is neither required nor expected of amonitoring system. If an IDS detects any threat, it alerts thesystem or network administrator. The objective of an IDS is todetect and inform active defenders about intrusions. An IDSalso uses techniques that can detect abnormalities both at thenetwork and host levels. Figure 1 shows a generic view of anIDS. The components are: a managing system, a monitoringcomponent and a detection component. The managing system oversees traffic flow in the network.It provides traffic information to the monitoring component for analysis. The monitoring component monitors traffic and analyzesthe behavior of the network. The detection component detects any suspicious behaviorwith respect to the normal working nature of the network.If any abnormal behavior is detected, it is communicatedto the reaction component. The reaction component reacts to the situation. After detection of abnormality, it raises an alarm so that the intrusion can be handled appropriately.(a) Prepare: In this first step, the attacker attempts to collect network configuration information using port scannersto identify vulnerabilities in the network (Bhuyan et al.,2011). Port scanning gathers information such as computer IP addresses, operating systems, open ports withidentities and version of listening software.(b) Exploit: Once vulnerabilities are identified, in the secondstep, the attacker attempts to exploit these vulnerabilities.The attacker may execute multiple attempts during thisstep.(c) Leave Behind: If the lunching of an attack is successful,the attacker installs additional software to create continued access to the network. This process, termed as leavebehind, includes installation of network sni ers or additional back-door network services.Figure 1: Intrusion Detection System: A Generic View(d) Clean Up: At last, the attacker tries to clean up any evidence left due to the actions in the previous steps. This stepmay include restarting daemons crashed during the secondstep, clearing logs and other information, and installingmodified system software designed to override the presence of other software from normal system commands.2.1. Based on Approach UsedFigure 2: Intrusion Prevention System: A Generic ViewBased on the approach used to counter intrusions the fourmain intrusion defense systems such as: intrusion detection systems, intrusion prevention systems, intrusion response systemsand intrusion tolerance systems are found to work as follows.2.1.2. Intrusion Prevention SystemAn IPS is considered an upgraded version of an intrusion detection system (Desai, 2009). They both monitor network traffic and/or system activities for malicious activity, but the maindi erence is that intrusion prevention systems are able to actively prevent intrusions that are detected. An IPS executes2.1.1. Intrusion Detection SystemAn intrusion detection system (IDS) (Ertoz et al., 2004)monitors a network or system for malicious activities or policy3

steps such as sending an alarm, dropping malicious packets, resetting the connection and/or blocking traffic from the o endingIP addresses. Figure 2 presents a generic view of an intrusionprevention system. The managing system, monitoring component and detection component are similar to those in an IDS, butin the reaction component prevention procedures are applied bythe prevention engine.against malicious attacks. In lieu of the general aim of preventing all intrusions, intrusion tolerance uses mechanisms thatprevent intrusions from leading to system security failure. As amatter of fact, intrusion tolerance is not a new concept. Classical fault tolerance techniques are useful for tolerating intrusion and error detection and recovery. Error hiding techniquescan also be applied to provide data integrity or service availability despite intrusions. However, such fault-tolerance techniques are usually considered harmful for data confidentialitydue to the redundancy that they imply. Figure 4 provides ageneric view of an intrusion tolerance system. The managingsystem, the monitoring component and the detection component are similar to those in an IDS, but the reaction componentuses tolerance techniques. In the reaction component, the prevention engine appliesprocedures according to the pattern of behavior of the suspicious traffic by working closely with the Managing system. The managing system manages the traffic flow and appliesthe procedures provided by prevention engine. In the reaction component, intrusion tolerance techniquestry to prevent intrusions from causing system failure. The monitoring system and the detection component worksimilarly to those in an IDS. Classical techniques may be useful and efficient.2.1.3. Intrusion Response SystemAn intrusion response system (IRS) (Stakhanova et al.,1991) continuously monitors system health based on IDS alerts,so that malicious or unauthorized activities can be handled effectively by applying appropriate actions to prevent problemsfrom worsening the situation and to return the system to ahealthy mode. A notification system generates alerts when anattack is detected. An alert can contain information like attackdescription, time of attack, source IP and user accounts usedto attack. An IRS automatically executes a preconfigured setof response actions based on the type of attack. An automatedapproach requires no human intervention, unlike an IDS wherethere is a delay between intrusion detection and response. Figure 3 shows the generic structure of an intrusion response system. It is comprised of a reaction component, a detection component, a monitoring component and a managing system. Inparticular, A tolerance approach di ers from the conventional way ofpreventing the attacks.Figure 4: Intrusion Tolerance System: A Generic View2.2. Modules of A Defense SystemIn this section, we discuss the components of a generic defense system. The reaction component has a response system, and It responds to the intrusion using a predefined approach inan automated manner.2.2.1. MonitoringNetwork monitoring collects data on the state of the network(Conorich, 2004). Traffic analysis requires inspection of services being used on a network or system and comparing themagainst activities that are expected. This allows one to identifysuspicious services within a network. To perform basic network monitoring, one needs to collect traffic characteristics atvarious points within the network. Although it is necessary tolook carefully at network borders, if there are internal hosts providing unauthorized services for other internal hosts, one willmiss this traffic if one only looks at the borders. There are fourdi erent types of TCP activity that should be considered.Figure 3: Intrusion Response System: A generic View Are three-way handshakes being completely executed ornot?2.1.4. Intrusion Tolerance SystemAn Intrusion tolerance system (Deswarte et al., 1991) takesa fault-tolerant design approach to defend information systems Are three-way handshakes being initiated but never successfully completed?4

Is a client getting any response to a connection attempt?The client often does two or three retries with slight delaysamong them in case of failure.single attack into a single meta-alert is aggregation. Thetask of clustering alerts into incidents is called correlation(Julisch, 2003). Is a client getting any negative response to a connectionattempt, for example, a TCP RST packet or an ICMP hostunreachable or port unreachable packet?To prevent an attack before damaging the network system,it is need to adopt preventive measure like, creating a databaseof detected signatures of abnormalities to filter out threateningpackets, analyze pattern of network behavior, reconfigure othersecurity controls etc. Trace-backing (Xiang and Zhou, 2004)the source of attack is a good way to prevent the attack in future. But, it also important to look for low collateral damagewhile trace backing a huge botnet attack. So, reaction procedure in terms of prevention is suitable aspect. Passive systemscan attempt to terminate the connection before an attack cansucceed, for example, by ending an existing TCP session.Researcher have demonstrated that no system can assure todetect and prevent from any kind of anomalous activities in aexposed and live network in a generic way. Thus, the solutionto react, lead in two di erent track. One option is that, respondthe attack or intrusion in an efficient way to provide the usualservice to general user and stop the service to the non-legitimateuser. Second option is to provide fault tolerance approach towards attack.2.2.2. DetectionA detection module provides reports (Mukherjee et al., 1994)to a management section . Some detection modules may try tostop an attack but this is neither required nor expected. Theintrusion detection module is primarily focused on identifyingpossible incidents, logging information about them and reporting intrusion attempts. A detection module can be used forvarious purposes such as identifying problems with securitypolicies, documenting existing threats and deterring individualsfrom violating security policies. A detection module acquiresand analyzes information from various areas within a computeror a network to identify possible security breaches, vulnerabilities, which include both intrusions and misuse. This modulemay use scanning, which is a technology developed to assesssecurity vulnerabilities of a computer system or network.2.3. Based on Nature of Control2.2.3. ReactionTypically, a defense system reacts using a two-step process.The first set of procedures constituting the passive component,involves inspection of the system’s configuration files to detectinadvisable settings, inspection of the password files to detectinadvisable passwords, and inspection of other system areas todetect policy violations. The second set of procedures constitute the active component. Here mechanisms are set in placeto react to known methods of attack and to generate systemresponses. IDSs can respond to suspicious events in severalways, which include displaying an alert, logging the event oreven paging an administrator. Alarm management can be categorized into two (Klüft and Staaf, 2012; Pietraszek and Tanner,2005).In this section, we discuss types of defense systems basedon the control structure used to counter attack traffic. Thereare three basic ways used to control detection and preventionprocesses, viz., centralized, hierarchical and distributed (Patelet al., 2013).2.3.1. CentralizedIn this type of defense, each detection element producesalerts locally. The generated alerts are sent to a central serverthat plays the role of a correlation handler and analyzes them.Using centralized control, an accurate detection decision can bemade based on all available alert information. The main drawback of this approach is that the central unit is crucially vulnerable; any failure in the central server leads to the collapse ofthe whole process of correlation. In addition, the central unitshould be able to handle the high volume of data which it mayreceive from the local detection elements in a short amount oftime. Alert/alarm quality improvement: This approach tries toimprove alert quality by using information such as vulnerability reports or alert contexts. One can prioritize alertswith respect to the vulnerabilities of the victims.2.3.2. HierarchicalThe whole system is divided into several small groups basedon features such as geography, administrative control, and software platforms. The IDPSs at the lowest level work as detectionelements while an IDPS at a higher level is furnished with botha detection element and a correlation handler, and it correlatesalerts from both its own level and lower levels. The correlatedalerts are then passed to a higher level for further analysis. Thisapproach is more scalable than the centralized approach, butstill su ers from the vulnerability of the central unit. Besides,the higher level nodes have a higher level abstraction of the input, which may limit their detection coverage. Alarm correlation: This approach creates a more ambitious goal. It tries to reconstruct higher-level incidentsfrom lower-level alerts. Sometimes, a defense system maygenerate more alarms than normal within a short period. Ifa set of alerts are triggered, and knowing this without anyadditional background knowledge, one cannot determinewhether these are coordinated/distributed attacks or independent attacks that happen to be interleaved. If it is a single multistage attack, alarms would have to be generatedin a single incident. In the case of multiple attacks, thealerts should be divided into multiple incidents, namely,one incident per attack. Grouping alerts that constitute a5

Table 2: Comparison of Control Mechanisms for Defense Against tages- Each IDPS acts as a detection element.- Every detection element produces alerts locally.- The central unit is crucially vulnerable.- Any failure in the central server leads to deactivation of the whole process of correlation.- The central unit handles high volume of data received from local detection elements.- Accurate detection decisions can be made basedon all available alert information.DistributedHierarchical- Need not have complete information of networktopology.- Possible to have a more scalable design sincethere is no central entity.- Local alarm correlation is simpler in this structure.- This approach is more scalable than the centralized approach.- Higher level nodes have higher level abstractionsof the input.- Information about all alerts is not available during decision making about detection.- Alert information may be too narrow to detectlarge scale attacks.- Su ers from the vulnerability of a central unit.- At each level, the detection coverage may be limited.tems with distributed management control. All participatingIDPSs have their own components communicating with eachother. The advantages of the fully distributed IDPS (Leitneret al., 2007) are that although the network entities do not havecomplete information about the network topology, it is possible to have a scalable design since there is no central entityresponsible for doing all the correlation work, and local alarmcorrelation is simpler in this structure. Meanwhile, the fully distributed approach has its own drawbacks (Zhou et al., 2010): (a)Information on all alerts is not available during decision making, so the accuracy may be reduced; (b) The alert informationusually has a single feature (like an IP address), which may betoo narrow to detect large scale attacks.Figure 5: Central Management StructureFigure 7: Distributed Management StructureFigure 6: Hierarchical Management StructureLooking at the di erent approaches to control we observethe following.2.3.3. DistributedIn this approach, there is no centralized coordinator to process the information, and is comprised of fully autonomous sys- Each of the three ways of control has advantages and disadvantages. We summarize them in Table 2.6

Table 3: Comparison Between Host-based and Network-based hs- It is good in detecting and verifying inside attacks as they reside on host.- It is able to decrypt encrypted packets in incoming traffic.- There is no need for additional hardware.- It is designed to work in large networks.- It is usually passive and can be easily deployedon an existing network with no disruption to thenormal network operation.- It is less susceptible to direct attack. Depending on the network under consideration we may beable to choose any one among them for defense.Limitations- They are vulnerable to both direct attacks andattacks against host operating system.- They are vulnerable to denial of service attacks.- Performance overhead may increase.- Due to large network size, there is chance thatthe system fails to recognize attacks.- They cannot analyze packets which are encrypted.- Whether the attack is successful or not may notbe reliably detected.occurs, it triggers an alarm and passes the message to the central computer system or an administrator, and generates an automatic response. In hierarchical and distributed defense, every level can detect attacks and react accordingly in its own neighborhood.Each level or each unit usually handles a low volume ofdata.2.5. Defense LocationAn intrusion defense system can be deployed in three possible locations: victim-end, intermediate and source-end. Eachhas its advantages and disadvantages. In centralized defense, only the central server takes part inthe decision making process. The server covers the entirenetwork with no redundancy.2.5.1. Victim-end defense mechanismVictim-end detection (Douligeris and Mitrokotsa, 2004) approaches are conventionally employed in the routers of the victim side network. The detection software stores informationabout known intrusion signatures or profiles of normal behavior. This information is updated by the processing elements asnew knowledge becomes available. The processing element ina detection engine frequently stores intermediate results in whatis called configuration data. Detecting attacks at the victim endis relatively easy, but requires higher resource consumption. Animportant drawback is that these approaches detect the attackonly after it reaches the victim and thus legitimate clients havealready been a ected.2.4. Based on Defense InfrastructureIn this section, we discuss various defense systems based onthe infrastructure used. These are two basic types, viz., hostbased and network-based.2.4.1. Host-basedIn this architecture, data is analyzed by individual computersthat serve as hosts. The network architecture used is agentbased, which means that a software agent resides on each of thehosts in the system. Thus, a host-based Intrusion Detection andPrevention System (HIDPS) processes data that originates onthe computers themselves, such as event and kernel logs. AnHIDPS (Yeung and Ding, 2003) can also monitor which program accesses which resources and may flag anomalous usage.An HIDPS also monitors the state of the system and makes surethat everything makes sense, which is necessary for the use ofanomaly filters.2.5.2. Intermediate network defense mechanismThe intermediate network defense scheme (Wang et al.,2001) balances detection accuracy and attack bandwidth consumption, which are the main issues in source-end and victimend detection approaches. The main difficulty with this approach is deployability. To achieve full detection, all routerson the Internet will have to use this detection scheme, becausenon-availability of this scheme on only a few routers may causedetection failure. Thus, full practical implementation of thisscheme is extremely difficult.2.4.2. Network-basedA network based detection system examines data exchangedamong computers in the network. A Network-based IntrusionDetection and Prevention System (NIDPS) (Vigna et al., 2004)captures network traffic from the wire as it travels to a host.This can be analyzed for a particular signature or for unusual orabnormal behaviors. Several sensors are used to sni packetson the network; these are computer systems designed to monitor network traffic. If any suspicious or anomalous behavior2.5.3. Source-end defense mechanismThis type is somewhat similar to victim-end detection. It isthe best option if we want to reliably detect or stop intrusion(Mirkovic and Reiher, 2005). It prevents congestion not onlyon t

tems, intrusion prevention systems, intrusion response systems and intrusion tolerance systems are found to work as follows. 2.1.1. Intrusion Detection System An intrusion detection system (IDS) (Ertoz et al., 2004) monitors a network or system for malicious activities or policy violations. Some systems or approaches may try to stop an in-