how to test an ids
play

How to Test an IDS? GENESIDS: An Automated System for Generating - PowerPoint PPT Presentation

Mar 28, 2024 •285 likes •671 views

How to Test an IDS? GENESIDS: An Automated System for Generating Attack Traffjc WTMC 2018 Felix Erlacher , Falko Dressler Network Intrusion Detection Systems (NIDS) Analyze network traffjc for malicous activity Felix Erlacher: How to Test an

  1. How to Test an IDS? GENESIDS: An Automated System for Generating Attack Traffjc WTMC 2018 Felix Erlacher , Falko Dressler

  2. Network Intrusion Detection Systems (NIDS) Analyze network traffjc for malicous activity Felix Erlacher: How to Test an IDS? GENESIDS 2 ▶ Anomaly based NIDS ▶ Have a model of ’normal’ traffjc ▶ Detect and alert deviations from ’normal’ traffjc ▶ Signature based NIDS ▶ Have rule-set of known attacks and incidents ▶ Detect rule patterns in analyzed network traffjc → Example: Snort

  3. How to test a NIDS? Manually creating attack traffjc? time intensive cumbersome SUMMARY: traces do not contain enough unique attacks Felix Erlacher: How to Test an IDS? GENESIDS 3 ▶ Real traffjc? ▶ hard to get ▶ public traces: old, no payload ▶ contains only very few attacks

  4. SUMMARY: traces do not contain enough unique attacks How to test a NIDS? Felix Erlacher: How to Test an IDS? GENESIDS 3 ▶ Real traffjc? ▶ hard to get ▶ public traces: old, no payload ▶ contains only very few attacks ▶ Manually creating attack traffjc? ▶ time intensive ▶ cumbersome

  5. SUMMARY: traces do not contain enough unique attacks How to test a NIDS? Felix Erlacher: How to Test an IDS? GENESIDS 3 ▶ Real traffjc? ▶ hard to get ▶ public traces: old, no payload ▶ contains only very few attacks ▶ Manually creating attack traffjc? ▶ time intensive ▶ cumbersome

  6. How to test a NIDS! GENESIDS: Generating Events for Signature-based Intrusion Detection Systems Felix Erlacher: How to Test an IDS? GENESIDS 4 ▶ INPUT: Set of attack descriptions ▶ Snort syntax ▶ HTTP attacks ▶ OUTPUT: Stateful network traffjc containing attack patterns ▶ One fmow per attack ▶ Annotated with an attack ID

  7. Rule example: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com Felix Erlacher: How to Test an IDS? GENESIDS 5

  8. Rule example: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com Felix Erlacher: How to Test an IDS? GENESIDS 5

  9. Rule example: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com Felix Erlacher: How to Test an IDS? GENESIDS 5

  10. Rule example: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com Felix Erlacher: How to Test an IDS? GENESIDS 5

  11. Rule example: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com Felix Erlacher: How to Test an IDS? GENESIDS 5

  12. Rule example: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com Felix Erlacher: How to Test an IDS? GENESIDS 5

  13. Rule example: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com Felix Erlacher: How to Test an IDS? GENESIDS 5

  14. Rule example: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com Felix Erlacher: How to Test an IDS? GENESIDS 5

  15. Rule example: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) genesids -f example.rule -s example.com Felix Erlacher: How to Test an IDS? GENESIDS 5

  16. Example traffjc in Wireshark: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) Felix Erlacher: How to Test an IDS? GENESIDS 6

  17. Example traffjc in Wireshark: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) Felix Erlacher: How to Test an IDS? GENESIDS 6

  18. Example traffjc in Wireshark: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) Felix Erlacher: How to Test an IDS? GENESIDS 6

  19. Example traffjc in Wireshark: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) Felix Erlacher: How to Test an IDS? GENESIDS 6

  20. Example traffjc in Wireshark: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST"; http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) Felix Erlacher: How to Test an IDS? GENESIDS 6

  21. Example traffjc in Wireshark: alert tcp any any -> any any ( msg:"This is an example rule"; content:"POST";http_method; uricontent:"|2F|evil.jpg"; pcre:"/AttackBody-V[0-9].*/P"; sid:1234567; rev:0;) Felix Erlacher: How to Test an IDS? GENESIDS 6

  22. GENESIDS Evaluation: Goals & Rules All supported Snort rules from: Snort.org subscriber rule-set Snort.org community rule-set Emerging Threats rule-set TOTAL 8101 difgerent rules Felix Erlacher: How to Test an IDS? GENESIDS 7 ▶ Ability to generate a variety of difgerent attacks ▶ Generated attacks trigger expected event

  23. GENESIDS Evaluation: Goals & Rules All supported Snort rules from: TOTAL 8101 difgerent rules Felix Erlacher: How to Test an IDS? GENESIDS 7 ▶ Ability to generate a variety of difgerent attacks ▶ Generated attacks trigger expected event ▶ Snort.org subscriber rule-set ▶ Snort.org community rule-set ▶ Emerging Threats rule-set

  24. GENESIDS Evaluation steps Felix Erlacher: How to Test an IDS? GENESIDS 8 TCP Connection HTTP Server Step 1 GENESIDS Signatures Signatures tcpdump 00101100101 Network 01001010010 00001110111 Trace 11100110100 10111010010 01010111111 Rules

  25. GENESIDS Evaluation steps Felix Erlacher: How to Test an IDS? GENESIDS 8 TCP Connection HTTP Server Step 1 GENESIDS tcpdump 00101100101 00101100101 Network Network 01001010010 01001010010 00001110111 00001110111 Trace Trace 11100110100 11100110100 10111010010 10111010010 Snort 01010111111 01010111111 Signatures Step 2 Alerts Rules Rules

  26. Evaluation results: Generated attacks Felix Erlacher: How to Test an IDS? GENESIDS 9 10000 Attacks Sent 8000 Attacks 6000 4000 2000 0 0 20 40 60 80 100 Experiment Run ▶ GENESIDS: 8101 attacks generated (out of 8101 rules)

  27. Evaluation results: True positives Felix Erlacher: How to Test an IDS? GENESIDS 10 10000 Attacks Sent 8000 Snort True Pos. Alerts Attacks 6000 4000 2000 0 0 20 40 60 80 100 Experiment Run ▶ Snort: 7877 (avg) true positive alerts triggered (out of 8101)

  28. Evaluation results: False positives triggered by 3 rules) Felix Erlacher: How to Test an IDS? GENESIDS 11 10000 Attacks Sent Snort True Pos. Alerts 5000 Snort False Pos. Alerts 2000 Attacks 1000 500 200 100 0 20 40 60 80 100 Experiment Run ▶ Snort: 2847 (avg) false positive alerts triggered (62%

  29. Evaluation results: False negatives not trigger the corresponding alert) Felix Erlacher: How to Test an IDS? GENESIDS once (out of 100) 12 10000 Attacks Sent Snort True Pos. Alerts 5000 Snort False Pos. Alerts 2000 Attacks 1000 500 200 Snort False Negatives 100 0 20 40 60 80 100 Experiment Run ▶ Snort: 223 (avg) false negatives (generated attacks that did ▶ Total of 363 rules generated attack not triggering at least

  30. Conclusion GENESIDS: Generating attack traffjc for NIDS testing defjnitions Felix Erlacher: How to Test an IDS? GENESIDS 13 ▶ Accepting Snort syntax → thousands of up-to-date attack ▶ 97% of generated attacks triggered corresponding alert ▶ Less than 3% failed to trigger corresponding alert

Recommend

Engineering Best Practices Test, test, test, and test some more; test as you go Start from a

Engineering Best Practices Test, test, test, and test some more; test as you go Start from a

Engineering Best Practices Test, test, test, and test some more; test as you go Start from a known working state, take small steps Make things visible (gdb, printf, logic analyzer) Methodical, systematic approach. Form hypotheses and perform

755 views • 38 slides
Test automation Whenever we alter our code, we should re-test Our collections of test cases

Test automation Whenever we alter our code, we should re-test Our collections of test cases

Test automation Whenever we alter our code, we should re-test Our collections of test cases can be substantial, and each test case can be large: manual testing is slow, error-prone Ideally, we would like a tool or script that lets us

186 views • 7 slides
Here is some test text Here is some test text Here is some test text By Mou Mount nt_Everes

Here is some test text Here is some test text Here is some test text By Mou Mount nt_Everes

Here is some test text Here is some test text Here is some test text By Mou Mount nt_Everes erest_as_see een_ n_fro rom_ m_Dru rukai air2. r2.jp jpg: g: shri rimpo mpo196 1967de 7deri rivat ative e wor work: : Papa pa Li

370 views • 32 slides
Compression Test Dr. Karim Helmy Compression Test Tension test is normally conducted to

Compression Test Dr. Karim Helmy Compression Test Tension test is normally conducted to

10/5/15 CB251 Testing of materials Compression Test Dr. Karim Helmy Compression Test Tension test is normally conducted to obtain the mechanical properties of Metals. It is the primary test used for quality control and the basis for

573 views • 7 slides
TEST AUTOMATION AT BMAR BMAR TEST TEAM Test Automation Planning 1. Selection Of Test

TEST AUTOMATION AT BMAR BMAR TEST TEAM Test Automation Planning 1. Selection Of Test

TEST AUTOMATION AT BMAR BMAR TEST TEAM Test Automation Planning 1. Selection Of Test Automation Tool Telerik Test Studio tool was selected. 2. Automation Projects - Agency Project- Yna - 26 developer, 5 tester, 12 years, 3.568.168 rows

591 views • 22 slides
TEST ANXIETY Strategies to Handle Test Anxiety OVERVIEW What is test anxiety? Positive verses

TEST ANXIETY Strategies to Handle Test Anxiety OVERVIEW What is test anxiety? Positive verses

TEST ANXIETY Strategies to Handle Test Anxiety OVERVIEW What is test anxiety? Positive verses negative thoughts Three stages of test anxiety Exercise and test anxiety Balanced diet with test anxiety POP procedure Myth verses Reality

379 views • 20 slides
The Handwriting of God Daniel 5 Here is some test text Here is some test text Here is some test

The Handwriting of God Daniel 5 Here is some test text Here is some test text Here is some test

Here is some test text Here is some test text Here is some test text The Handwriting of God Daniel 5 Here is some test text Here is some test text Here is some test text 1. God warns us not to trust the security of earthly kingdoms Here is

707 views • 39 slides
Model-Based Testing (ISTQB Chapter 4) Arie van Deursen 1 4.1 ISTQB Test Design Test Scripts

Model-Based Testing (ISTQB Chapter 4) Arie van Deursen 1 4.1 ISTQB Test Design Test Scripts

Model-Based Testing (ISTQB Chapter 4) Arie van Deursen 1 4.1 ISTQB Test Design Test Scripts Test Basis 4.1.2: Test Analysis 4.1.4: Test Implementation Test Selected Test Cases Test Conditions Conditions 4.1.3: Test Design 2 Test

1.18k views • 38 slides
Quality Assurance: Test Development & Execution Developing Test Strategy Ian S. King Test

Quality Assurance: Test Development & Execution Developing Test Strategy Ian S. King Test

Quality Assurance: Test Development & Execution Developing Test Strategy Ian S. King Test Development Lead Windows CE Base OS Team Microsoft Corporation Elements of Test Strategy Where is your focus? Test specification The

427 views • 5 slides
The Son of God is Tempted Matthew 4:1-11 Here is some test text Here is some test text Here is

The Son of God is Tempted Matthew 4:1-11 Here is some test text Here is some test text Here is

Here is some test text Here is some test text Here is some test text The Son of God is Tempted Matthew 4:1-11 Here is some test text Here is some test text Here is some test text 1. Jesus is temped to gratify His desires apart from Gods

418 views • 15 slides
EMC TEST REPORT DIRECTORY A) Documentation Directory 2 Test Standards 3 Address of the test

EMC TEST REPORT DIRECTORY A) Documentation Directory 2 Test Standards 3 Address of the test

EMC TEST REPORT CE TEST REPORT Report Number : ETLE080619.495 Report issue date : July 21, 2008 Model / Serial No. : HWC-640 / NONE Multiple Model Name : HWC-630, HWC-650, HWC-660, HWC-680 Product Type : Hot & Cold Water Purifier

522 views • 35 slides
Innovative Test Technology and Test Procedures for Components of Railway Chassis Agenda (1)

Innovative Test Technology and Test Procedures for Components of Railway Chassis Agenda (1)

Innovative Test Technology and Test Procedures for Components of Railway Chassis Agenda (1) Introduction - Accidents, developments and current status (2) Testing and state-of-the-art test systems in 2019 (3) Perspective test systems (4) Test

552 views • 53 slides
EMC TEST REPORT DIRECTORY A) Documentation Directory 2 Test Standards 3 Address of the test

EMC TEST REPORT DIRECTORY A) Documentation Directory 2 Test Standards 3 Address of the test

EMC TEST REPORT CE TEST REPORT Report Number : ETLE070516.328 Report issue date : June 27, 2007 Model / Serial No. : ROMEO III / NONE Multiple Model Name : W2-360H, W2-340H, W2-300H, W2-310H Product Type : POU Water Cooler Applicant

612 views • 36 slides
Huamei Dong 04/12/2016 1. Z test or T test for one mean (one sample) or two means (two samples)

Huamei Dong 04/12/2016 1. Z test or T test for one mean (one sample) or two means (two samples)

Lab Huamei Dong 04/12/2016 1. Z test or T test for one mean (one sample) or two means (two samples) 2. Chi square test for two categorical data 3. ANOVA F test for comparing two means or more than two means 4. T test for simple linear

552 views • 18 slides
200511316 200511316 Test plan Test design specification g p

200511316 200511316 Test plan Test design specification g p

200511316 200511316 Test plan Test design specification g p Test case specification Test procedure specification Test procedure specification Test item transmittal report Test log l Test

493 views • 38 slides
God Pursues Us with NEW LIFE Ezekiel 37:1-14 Here is some test text Here is some test text Here

God Pursues Us with NEW LIFE Ezekiel 37:1-14 Here is some test text Here is some test text Here

Here is some test text Here is some test text Here is some test text God Pursues Us with NEW LIFE Ezekiel 37:1-14 Here is some test text Here is some test text Here is some test text 1. Gods people are spiritually dead and scattered in

364 views • 25 slides
Phylum Cnidaria Test Phylum Cnidaria Test For test items 81 100, match the organism to

Phylum Cnidaria Test Phylum Cnidaria Test For test items 81 100, match the organism to

Phylum Cnidaria Test Phylum Cnidaria Test For test items 81 100, match the organism to its class. You can find the classes listed as selections on page 6 of your test. a.Anthozoa 81. b.Cubozoa c.Hydrozoa d.Scyphozoa a.Anthozoa

619 views • 28 slides
Big-O-ology Problem You can only run a few test cases. There will be many inputs you wont test

Big-O-ology Problem You can only run a few test cases. There will be many inputs you wont test

How do you tell how fast a program is? Answer? Run some test cases. Big-O-ology Problem You can only run a few test cases. There will be many inputs you wont test ...and BAD things may be happening on that stuff. Jim Royer FIX? Test all

78 views • 7 slides
Presentation Objectives Test coverage concepts Advantages of automated test coverage

Presentation Objectives Test coverage concepts Advantages of automated test coverage

Automated Test Coverage: Take Your Test Suites To the Next Level Presented By Jay Berkenbilt Apex CoVantage Solving the Software Quality Puzzle Page 1 www.psqtconference.com D Presentation Objectives Test coverage

412 views • 29 slides
18-04-16 Methodology FORMAT: one-to-one with an experienced researcher. Each test takes about 15

18-04-16 Methodology FORMAT: one-to-one with an experienced researcher. Each test takes about 15

18-04-16 ASL ASSESSMENT PROJECT Standardizing Signed Language Assessment Measures: ASL Phonological Awareness Test ASL Receptive Skills Test ASL Expressive Skills Test Linda J Cundy, M.Ed Research Associate Western Canadian

269 views • 7 slides
God Calls a Spokesman The Book of JEREMIAH Here is some test text Here is some test text Here

God Calls a Spokesman The Book of JEREMIAH Here is some test text Here is some test text Here

Here is some test text Here is some test text Here is some test text God Calls a Spokesman The Book of JEREMIAH Here is some test text Here is some test text Here is some test text 1. Gods plan for us precedes our birth Here is some test

640 views • 21 slides
Promotion Test 2020 When is Promotion Test? Promotion Test would be held on the 20th of October

Promotion Test 2020 When is Promotion Test? Promotion Test would be held on the 20th of October

Promotion Test 2020 When is Promotion Test? Promotion Test would be held on the 20th of October 2020 for ALL batches. 2 16th Batch Promotions Test Ranks to be Taken All cadets in 16th Batch would be taking the test to promote to the rank of

160 views • 14 slides
EMC TEST REPORT DIRECTORY Pages A) Documentation Directory 2 Test Standards 3 Address of

EMC TEST REPORT DIRECTORY Pages A) Documentation Directory 2 Test Standards 3 Address of

EMC TEST REPORT DIRECTORY Pages A) Documentation Directory 2 Test Standards 3 Address of the test laboratory, Conditions/Power Utilized, 4 Description of the EUT & Symbol Definitions Equipment under Test 17 General Remarks &

987 views • 76 slides
Rebuilding Jerusalems Wall Nehemiah 4-6 Here is some test text Here is some test text Here

Rebuilding Jerusalems Wall Nehemiah 4-6 Here is some test text Here is some test text Here

Here is some test text Here is some test text Here is some test text Rebuilding Jerusalems Wall Nehemiah 4-6 Here is some test text Here is some test text Here is some test text 1. Gods People act wisely in the face of conflict Here

1.05k views • 32 slides

More recommend