Network Security Hacks [Electronic resources] نسخه متنی

Hack 89 Detect Anomalous Behavior

Detect attacks and intrusions by monitoring
your network for abnormal traffic, regardless of the actual
content.

Most NIDS monitor the
network for specific signatures of attacks and trigger alerts when
one is spotted on the network. Another means of detecting intrusions
is to generate a statistical baseline of the traffic on the network
and flag any traffic that doesn't fit the
statistical norms. One intrusion detection system of this type is
Spade (http://www.silicondefense.com/software/spice/).

Spade, or the Statistical Anomaly Detection Engine, is
actually a modified version of Snort that extends its functionality
into the realm of anomaly-based intrusion detection. The
Spade preprocessor uses Snort to monitor the
network and then constructs probability tables based on the traffic
that it sees. It then uses this table to generate an anomaly between
and 1 for each packet (i.e., 0 is a definite normal, and 1 is a
definite anomaly).

Installing Spade is easy. Just download the
source distribution, unpack it, and change into the directory that it
created. Then type a command similar to this, which will patch your
Snort source code:

$ make SNORTBASE=../snort-2.0.5

Of course, if your Snort source tree isn't at
../snort-2.0.5, you'll need to
specify a different path.

Now change to the directory containing the Snort source code, and
compile and install Snort as you normally would [Hack #82] .
Once you've done that, you'll need
to configure Snort to use Spade. You have two
choices here: setting it up to use only Spade
functionality or using normal Snort functionality along
with Spade. For the former, you can use the
spade.conf located in the
Spade source distribution as a starting point.

Most of the defaults are fine. However, you will need to set the
SPADEDIR variable to a place where Snort has read
and write access.
Spade will keep
various logs and check-pointing information here so that it does not
lose its probability table whenever Snort is restarted.

For example:

var SPADEDIR /var/log/snort/spade

It is also important that you tell Spade what
network is your "home" network. You
can do this by using a line similar to this one in your configuration
file:

peprocessor spade-homenet: 192.168.1.0/24

You can specify multiple networks by separating them with commas and
enclosing the list in square brackets.

If you want to run Snort with Spade and
traditional Snort functionality, you can just include your
spade.conf in your
snort.conf with a line like this:

include spade.conf

Run Snort just as you did before. Spade will now
send its output to any of the output plug-ins that you have
configured when it detects anomalous behavior. This is triggered when
a given packet's anomaly score is in the range of .8
to .9 (it depends on the type of packet). Any
alerts generated by
Spade will be prefixed with
Spade: and will include a description of the
packet's deviant behavior and its anomaly
score.