Developing Intrusion Detection Systems Through Behavior Analysis

Recently at the Recorded Future User Network (RFUN) conference, I had the privilege of meeting Dr. Ben Shneiderman from the University of Maryland. Dr. Shneiderman is a Computer Science professor and founding director of the Human Computer Interaction Lab (HCIL) at University of Maryland.

Dr. Shneiderman demonstrated for us several amazing data analysis tools which have been developed at the HCIL, including LifeLines and EventFlow, two tools designed for temporal analysis and visualization of events. While these tools were designed to analyze medical events around patient care, I wondered if they could also be applied to analyze patterns used by attackers against my honeypots.

The first step was to take all of my honeypot logs and turn them into something EventFlow could understand. I imported the logs into Splunk, and started identifying fields. After careful consideration, the only fields I really care about for this analysis are the session number, source IP address, and the main commands being entered by the attacker, such as "who" "ls" "rm" etc. I combined the source IP and session number to create a session ID, so that EventFlow would treat each connection by each IP address separately.

Tricks of the Trade - New Whitepaper Available (Malware evading Intrusion Detection)

I'm happy to announce that I've completed my whitepaper on how malware attempts to evade detection by intrusion detection systems.

In this paper I take a look at how malware attempts to evade detection by both network-based and host-based intrusion detection systems through some very clever techniques. All of the malware featured was captured by my own personal honeypots.

Please view or download the paper over at Scribd:
Tricks of the Trade - How Malware Authors Cover Their Tracks

FREE eBook: Intrusion Detection Systems with Snort: Advanced IDS Techniques

Receive Your Complimentary eBook NOW!

"Intrusion Detection Systems with Snort: Advanced IDS Techniques Using Snort, Apache, MySQL, PHP, and ACID"

Protect your network with Snort: the high-performance, open source IDS. Snort gives network administrators an open source intrusion detection system that outperforms proprietary alternatives.

Now, Rafeeq Ur Rehman explains and simplifies every aspect of deploying and managing Snort in your network. You'll discover how to monitor all your network traffic in real time; update Snort to reflect new security threats; automate and analyze Snort alerts; and more. Best of all, Rehman's custom scripts integrate Snort with Apache, MySQL, PHP, and ACID - so you can build and optimize a complete IDS solution more quickly than ever before.

• An expert introduction to intrusion detection and the role of Snort
• Writing and updating Snort rules to reflect the latest attacks and exploits
• Contains detailed coverage of Snort plug-ins, preprocessors, and output modules
• Logging alerts to a MySQL database
• Using ACID to search, process, and analyze security alerts
• Using SnortSnarf to analyze Snort log files
• XML support for Snort via the Simple Network Markup Language (SNML)

Request your free copy today!

Abandoning the Client-Server Model

Once every two weeks, I will try to write an in-depth blog post on an interesting topic within the security community.  My first topic is why the client-server model should be abandoned for antivirus and host intrusion detection/prevention.

It always seems that malware creators are always 1 step ahead of the security community.  Their methods for deploying and updating sophisticated botnets seems to be ever evolving, while the security community lags behind in technology.