Intrusion Detection and Advanced Persistent Threats

1
Intrusion Detection and Advanced Persistent
Threats

• CS 591
• Andrew Bates
• University of Colorado at Colorado Springs

2
Introduction

• What is the Advanced Persistent Threat
• Pattern Based Intrusion Detection
• Proposal
• Conclusion

3
What is APT

• Combination of many existing known threats not
  just Phishing or Spear Phishing
• Social Engineering
• Zero Day Exploits
• Botnets
• Whats different? Persistent!
• Exploits custom built for a given attack
• Threat or attack can span many months
• Very carefully crafted
• Low Volume

4
APT and Intrusion Detection Systems

• IDS very good at alerting known exploits and
  vulnerabilities
• IDS also good at identifying Denial of Service
  (DoS) and Distributed DoS (DDoS) attacks
• APT can be low volume and may not actually
  exploit any known vulnerability
• Targeted email that coerces victim to download
  and run some software

5
Pattern Based Intrusion Detection

• Always one step behind
• Must know of a vulnerability in order to build
  pattern
• Can have very high false positive rate in large
  organizations
• Must know what normal behavior is
• Very high maintenance

6
Pattern Based Intrusion Detection

• On small networks can have hundreds of alerts in
  short period of time
• If the relationship between number of hosts and
  number of alerts/false positives is linear

7
Proposal

• Push IDS as close to the host as possible
• Use learning algorithms to determine normal
  activity
• Trigger on anomalous activity
• Score sessions based on triggers and then perform
  more strenuous tests
• Pattern matching, traffic analysis, etc.

8
Proposal

• Leverage VM technology to place inline IDS/IPS
  with host system
• Funnel data to central collection/correlation
  infrastructure
• Alert on anomalous activity based on learned
  normal behaviour

9
Conclusion

• APT is just like any other threat, but may be
  lower volume and more targeted
• Pattern based IDS not well suited for APT
  detection in an Enterprise
• Push IDS towards the host, perhaps even on the
  physical hardware
• Learn normal behavior and trigger further tests
  when abnormal behavior occurs

10
Questions?