CYB 6030 Wilmington Week 1 Intrusion Detection and Prevention Systems Video Discussion Week 1 Discussion Board 2828 unread replies.2929 replies. Watch th

CYB 6030 Wilmington Week 1 Intrusion Detection and Prevention Systems Video Discussion Week 1 Discussion Board

2828 unread replies.2929 replies.

Watch the following video on Intrusion Detection and Prevention Systems (IDS/IPS).

Intrusion Detection and Prevention Systems (IDS/IPS): Computer Security Lectures 2014/15 S1 (Links to an external site.)

For this week’s discussion, consider the following:

Discuss the critical need for IDS/IPS and the potential risks associated with this type of technology.
Research and discuss one recent cyber incident and how it impacted the company in revenue, profit or brand.
Discuss the similarities, differences and overlap for IPS, IDS and HIDS. Please express and justify your point of view.

Week 1 Case Study Questions

Instructions

SAVE THE ATTACHED ASSIGNMENT FILE TO YOUR COMPUTER.
READ THE INSTRUCTIONS FOR THE ASSIGNMENT CAREFULLY.
ANSWER ALL OF THE QUESTIONS ON THE ASSIGNMENT.
PROVIDE CITATIONS AND REFERENCES FOR ALL RESEARCH SOURCES THAT YOU USE. IF YOU NEED HELP WITH CITATIONS AND REFERENCES, CLICK THIS LINK: APA CITATION STYLE (CORNELL UNIVERSITY, 2011). (LINKS TO AN EXTERNAL SITE.)
UPLOAD YOUR COMPETED ASSIGNMENT AND SUBMIT.
ATTACHMENTS
CYB6030WEEK1CASESTUDYQUESTIONS.DOCX
WEEK 1 – CASE STUDY.PDF

Week 1 Hands-on Exercise
INSTRUCTIONS
Save the attached assignment file to your computer.
Read the instructions for the assignment carefully.
Answer all of the questions on the assignment.
Provide Citations and References for all research sources that you use. If you need help with citations and references, click this link: APA Citation Style (Cornell University, 2011). (Links to an external site.)
Upload your competed assignment and submit.
ATTACHMENTS
CYB6030Week1HandsOnExercise.docx
PREVIOUS WEEK 1 HANDS-ON EXERCISE” STYLE=”FLOAT: RIGHT;” >NEXT CYB 6010: Week 1 Hands-on Exercise
A. Read and Review the McAfee Network Security Platform (NSP) User Guide
B. After reading and reviewing the McAfee Network Security Platform (NSP) User Guide, perform
the following steps/exercises:
1)
2)
3)
4)
5)
6)
7)
8)
9)
Logon to the VM
Login to the NSP
Logon to the NSM
Process traffic through the NSP
Analyze the alerts that appear on the NSM console
Take a screenshot of the NSM console with the top 10 alerts
Research and write a report for the top 10 alerts that appear within the NSM Alert tab
Develop recommendations for Wilmington University if the alerts were seen on campus.
Submit a single file document with the screenshot, research for top 10 alerts and
recommendations – the paper should not exceed 5 pages.
CYB 6030: Week 1 Case Study Questions:
A. Please read the following paper:
Anwar, S., Mohamad Zain, J., Zolkipli, M. F., Inayat, Z., Khan, S., Anthony, B., & Chang,
V. (2017). From Intrusion Detection to an Intrusion Response System: Fundamentals,
Requirements, and Future Directions. Algorithms, 10(2), 39.
http://www.mdpi.com/1999-4893/10/2/39
B. After you read the paper, answer the following questions:
1) According to the article what is the differences between IPS, IDS and IRS?
2) How would you employ IPS, IDS and IRS in a large network?
3) How would you employ IPS, IDS and IRS in a small network?
4) What are the best practices for IPS/IDS/IRS for any organization?
5) What recommendations would you have for Wilmington University Library?
CYB 6010: Week 1 Hands-on Exercise
A. Read and Review the McAfee Network Security Platform (NSP) User Guide
B. After reading and reviewing the McAfee Network Security Platform (NSP) User Guide, perform
the following steps/exercises:
1)
2)
3)
4)
5)
6)
7)
8)
9)
Logon to the VM
Login to the NSP
Logon to the NSM
Process traffic through the NSP
Analyze the alerts that appear on the NSM console
Take a screenshot of the NSM console with the top 10 alerts
Research and write a report for the top 10 alerts that appear within the NSM Alert tab
Develop recommendations for Wilmington University if the alerts were seen on campus.
Submit a single file document with the screenshot, research for top 10 alerts and
recommendations – the paper should not exceed 5 pages.
algorithms
Review
From Intrusion Detection to an Intrusion
Response System: Fundamentals, Requirements,
and Future Directions
Shahid Anwar 1, *, Jasni Mohamad Zain 2 , Mohamad Fadli Zolkipli 1 , Zakira Inayat 3,4 ,
Suleman Khan 4 , Bokolo Anthony 1 and Victor Chang 5
1
2
3
4
5
*
Faculty of Computer Systems & Software Engineering (FSKKP), Universiti Malaysia Pahang, Lebuhraya Tun
Razak Gambang, 26300 Kuantan, Malaysia; fadli@ump.edu.my (M.F.Z.); bkanjr@gmail.com (B.A.)
Center for Computer Technology & Networking Studies, Faculty of Computer & Mathematical Sciences,
Universiti Teknologi MARA (UiTM), 40450 Shah Alam, Malaysia; jasni@tmsk.uitm.edu.my
Department of Computer Science, University of Engineering and Technology Peshawar, Peshawar 2500,
Pakistan; zakirainayat@uetpeshawar.edu.pk
Center for Mobile Cloud Computing Research (C4MCCR), University of Malaya, 50603 Kuala Lumpur,
Malaysia; suleman@siswa.um.edu.my
International Business School Suzhou (IBSS), Xi’an Jiaotong-Liverpool University, 111 Ren’ai Road,
Suzhou Dushu Lake Science and Education Innovation Industrial Park, Suzhou 215123, China;
victorchang.research@gmail.com
Correspondence: shahidanwar.safi@gmail.com; Tel.: +60-112-555-4858
Academic Editors: Sye Loong Keoh and Khin Mi Mi Aung
Received: 24 February 2017; Accepted: 24 March 2017; Published: 27 March 2017
Abstract: In the past few decades, the rise in attacks on communication devices in networks has
resulted in a reduction of network functionality, throughput, and performance. To detect and mitigate
these network attacks, researchers, academicians, and practitioners developed Intrusion Detection
Systems (IDSs) with automatic response systems. The response system is considered an important
component of IDS, since without a timely response IDSs may not function properly in countering
various attacks, especially on a real-time basis. To respond appropriately, IDSs should select the
optimal response option according to the type of network attack. This research study provides
a complete survey of IDSs and Intrusion Response Systems (IRSs) on the basis of our in-depth
understanding of the response option for different types of network attacks. Knowledge of the path
from IDS to IRS can assist network administrators and network staffs in understanding how to tackle
different attacks with state-of-the-art technologies.
Keywords: intrusion; attacks; information security; response option; intrusion detection
1. Introduction
As a result of the technological advances in recent years, we have become increasingly dependent
on global networks when engaging in social, business, and educational activities. With the explosive
use of computer networks, a number of security issues on the Internet and in computer systems
have been raised. Hence, the security of Internet-connected devices from various threats has become
considerably important to ensure system availability and integrity [1]. Based on the annual report of
2016 from Asia Pacific Computer Emergency Response Team (CERT) showed a tremendous increment
in the amount of intrusions and cyber-attacks over the decade [2]. Similarly, according to a report
from the Malaysia CERT published in 2016, 43% of 9986 malicious incidents involve intrusions
during system operating hours [3]. An intrusion is a set of actions that violate security policies,
including the integrity and confidentiality of data and the availability of services as well, by exploiting
Algorithms 2017, 10, 39; doi:10.3390/a10020039
www.mdpi.com/journal/algorithms
Algorithms 2017, 10, 39
2 of 24
the vulnerabilities in the security procedure and the implementation of the system monitored by
an IDS [4,5]. By contrast, attacks can be said to be adversarial intrusions against IDS or simply
a set of actions that violate the security policies associated with the IDS itself [5,6]. Despite the
development of several defensive techniques such as cryptography, firewalls, and access control for
secure communication, these anti-threat systems currently possess limitation in detecting intrusion
attacks. Therefore, an IDS with appropriate countermeasures, such as an intrusion response system
(IRS), is essential for detecting and responding to potential intrusions and attacks [7].
IDSs are the hardware or software systems that autonomously identify and response
in-appropriate events (such as intrusion attacks) occur in computer systems [4]. Depending on
IDS settings and configurations, IRSs can continuously monitor system health and apply suitable
countermeasures to identify and respond to potential incidents and inappropriate activities effectively
and hence ensures optimal security in any computing environment [8]. IDS is categorized into
three types, namely intrusion tolerance, intrusion prevention system (IPS), and IRS [6,7]. The term
“intrusion tolerance” is defined by [6], the capability of a personal computer system to maintain
its integrity, confidentiality, and availability even when some of its components are being infected.
An intrusion-prevention-system (IPS) is an IDS that generates a proactive response to stop attacks
before they occur [8]. In contrast, IRS is always activated after the detection of attacks by IDS and is
always generates reactive response. However, existing IDSs only provide a limited response approach
and are inadequate to provide optimum response in detected intrusions. Therefore, a response option
should be deployed according to the nature of attacks and IDS confidence should be improved in
attaining suitable response.
Although IRSs have always been used with IDSs, they have been few research studies conducted
on IRSs by academicians and researchers. Firewalls prevent external attacks only and mostly fail to
detect internal attacks. To mitigate internal attacks, an intrusion detection and response system that
detects and responds to threats in real time is needed. Therefore, security-related problems need to be
correctly identified to ensure that suitable response options are selected for detected possible attacks.
However, not all incidents are malicious in nature; for instance, a person may mistakenly obtain access
to a different system by typing the address of a computer without authorization. In a different instance
the same action might be performed by a cybercriminal and such an action is regarded as malicious
because cybercriminals are highly skilled programmers with the intent to exploit vulnerabilities in
computer systems. Thus, there is need for an IRS to distinguish malicious activity (cyber-criminal)
from non-malicious activity (a person mistakenly obtaining access) and select an appropriate response
option accordingly.
Furthermore, the response options should be selected according to the attacker’s activity.
For example, when an attacker has already logged out, terminating the session of the attacker will not
be appropriate and will have no effect. Similarly, the attackers try to launch denial of service (DOS) or
distributed denial of service (DDoS) attacks to make the resources unavailable to authorized users.
A response option that increases service availability and performance is imperative. In spoof attacks,
internal attacks, distributed attacks, and password-based attacks, attackers attempts to get access to
personal data that is stored on a personal computer. Once the attacker gets access to the confidential
information, the attacker can easily modify the stored data; in such cases, the response should be to
enforce data integrity and confidentiality. In probing, phishing, and eavesdropping, attackers mostly
attempt to collect credentials from the worldwide network and information about susceptibility as
well. Thus, these types of attacks require a response option that improves data confidentiality and
service availability.
This study aims to categorize network attacks and review the general attacks that may occur in
computer systems. In addition, this study proposes response options according to intrusion and attack
statistics. The rest of the paper is organized as follows. A description of different attacks detected
by IDSs and a comparison of attacks according to affected parameters are presented in Section 2.
Section 3 explains the common solution to intrusions. Section 4 describes the comparison of attacks
Algorithms 2017, 10, 39
3 of 24
according to the affected parameters and various threats. Section 5 illustrates the responses to possible
attacks. Sections 6 and 7 present the current challenges faced by IRSs and future directions. Finally, the
conclusions of the study are presented in Section 8. Table 1 briefly outlines a list of acronyms used in
this research paper.
Table 1. List of acronyms.
Symbol
IDS
IRS
IPS
IDRS
DIDS
CIA
DOS
DDOS
NIDS
HIDS
AD
SD
AIRS
AAIRS
CSM
MANET
GIDP
IDAR
AudES
Description
Intrusion Detection System
Intrusion Response System
Intrusion Prevention System
Intrusion Detection and Response System
Distributed Intrusion Detection System
Confidentiality, Integrity, Availability
Denial of Service
Distributed Denial of Service
Network-Based Intrusion Detection System
Host-Based Intrusion Detection System
Anomaly Detection
Signature Based Detection
Automatic Intrusion Response System
Adaptive Automatic Intrusion Response System
Cooperating Security Managers
Mobile Ad hoc Network
Generalized Intrusion Detection System
Intrusion-Detection and-Adaptive Response-Mechanism
Audit Expert System
2. Types of Intrusion
At the moment the majority of networks are basically unsecured, which creates opportunities for
cybercriminals to access secure data. Attackers are interested in stealing information and also attempt
to make digital resources unavailable to users. Numerous defensive techniques such as access control,
cryptography, and firewalls can function as the front line of defense against external and internal
attacks [6]. Firewalls mainly secure the front access points of a network connected node from a number
of threats and attacks [7]. Cryptography allows for secure communication, whereas access control
is deployed for authentication purposes. However, these anti-threat applications can only provide
external security and are thus inadequate in detecting internal attacks or providing internal security
to any computer system and network. IDSs address this problem by monitoring and detecting both
internal and external attacks.
IDSs are hardware or software systems that automatically identify and respond to attacks
on computer systems. Depending on IDS alerts, IRSs continuously monitor system health to
effectively identify and address potential incidents or inappropriate activities [4]. IRSs apply suitable
countermeasures to ensure security in a computing environment. Consequently, a proper mechanism
for checking the optimum response of these systems is to implement alert procedures. In addition,
techniques for statistically detecting attacks and categorizing attacks in terms of how they affect data
integrity, availability, and confidentiality are necessary. For instance, if an attack affects the integrity
of an enterprise database system, there is a need for an appropriate response to secure data integrity.
However, if the attack is against the network the response should improve resource availability and
network performance.
Responses cannot be evaluated without considering the proceeding incidents, as seen in Figure 1.
Thus, in this instance, the main objectives of incident classification are to examine possible incidents,
determine actual attacks and respective targets, and choose appropriate response options to counter
such attacks. Thus, an incident may refer to any unexpected event that occurs during a program
Algorithms 2017, 10, 39
4 of 24
execution in a network [8]. Specifically, an-incident occurs when an attack (natural or man-made)
resources [9]. Most of the security attacks are categorized based on Figure 41.of 23
exploits information
Algorithms
2017, 10, 39
Figure 1.
1. Types
of intrusions/attacks.
intrusions/attacks.
Figure
Types of
However, in passive attacks, attackers only eavesdrop but do not modify any information in the
However, in passive attacks, attackers only eavesdrop but do not modify any information in
system, whereas in active attacks, attackers attempt to gain unauthorized access and change
the system, whereas in active attacks, attackers attempt to gain unauthorized access and change
information in the system with intent to destroy the entire network. Systems must be capable of
information in the system with intent to destroy the entire network. Systems must be capable of
rapidly recovering from such attacks. An IDS with an IRS enables a computer system to mitigate the
rapidly recovering from such attacks. An IDS with an IRS enables a computer system to mitigate
damage and recover rapidly from incidents. These incidents are broadly divided into two sub-classes:
the damage and recover rapidly from incidents. These incidents are broadly divided into two
network-based incidents and host-based incidents [10]. The application layer includes host-based
sub-classes: network-based incidents and host-based incidents [10]. The application layer includes
attacks such as spamming, race condition attacks, buffer overflow attacks, mail forgery, and man-inthe-middle attacks. Host-based attacks are mostly attacks against system availability, operating
systems performance, and web service operations [11]. Network-based incidents include attacks on
networks aimed at affecting network availability and performance. Unlike in wired networks, in
Algorithms 2017, 10, 39
5 of 24
host-based attacks such as spamming, race condition attacks, buffer overflow attacks, mail forgery, and
man-in-the-middle attacks. Host-based attacks are mostly attacks against system availability, operating
systems performance, and web service operations [11]. Network-based incidents include attacks on
networks aimed at affecting network availability and performance. Unlike in wired networks, in which
attackers target victim networks through firewalls and gateways, attackers of wireless ad hoc networks
usually gain access from several access point and target any open node.
Figure 1 presents a diagram of a computer network and also presents general attacks that may be
targeted at an organization [10,12]. These attacks are categorized as insider, outsider, active, passive,
distributed, sniffing, spoofing, and DDoS/DoS attacks. These attacks can have some effects on system
security policies such as confidentiality, integrity, and the availability of computing resources (CIA).
Table 2 describes general attacks and network-based attacks. A detailed description of each attack
is given in the following table. The main categorization of these attacks is presented based on Table 2,
which highlights active attacks, passive attacks, insider attacks, outsider attacks, DoS, DDoS, covert
channel attacks, and side channel attacks. The attack classification aims to support the selection of a
suitable response option on the basis of the specific attack behavior.
Table 2. Types of intrusions/attacks.
Types of Attacks
Active Attacks
Ref.
[7]
Attack Name
Routing
Attacks
Description
Black Hole
Refers to dropped traffic in networks.
Gray Hole
Behaves like a malicious node to drop malicious packets,
but later switches back to normal.
Rushing
A malicious node raising the speed of the routing process.
Man in the
Middle
Attacker secretly relays and intercepts messages between
two parties.
Sleep
Deprivation
It targets the sensor of nodes to maximize power
consumption.
Spoof
When an attacker imitates someone else’s device or a user
in order to initiate attacks against network hosts, bypass
access controls, steal data, or spread malware.
Sybil
It is an attack wherein a reputation system is subverted by
foreign identities in P2P networks.
Malicious Packet Dropping
Passive Attacks
[5]
It is a type of DDoS attack similar to black hole attacks.
Eavesdropping
Network layer attacks that intercept private
communication.
Traffic Analysis
An attack that examines the communication patterns
between entities in a system.
Location Disclosure
Can expose anything about the network structure or the
nodes’ locations.
Algorithms 2017, 10, 39
6 of 24
Table 2. Cont.
Types of Attacks
Ref.
Attack Name
Hijacked
Defacement
It changes the physical appearance of a website or page.
Phishing
It is an e-mail fraud scam that tries to obtain credentials
such as credit card details, usernames, and passwords.
Illegal Investment
Account Compromised
Fraud
[9]
Purchase
Using fake or stolen credit card for a transaction. The most
common fraud is credit cards.
Counterfeit Item
Online
Covert Channel
Attacks
[11]
–
Storage Channel Attacks
Timing Channel Attacks
Timing-driven attacks
Side-Channel-Attacks [12]
This fraud occurs when a user opens an infected website.
Unauthorized Transaction
[10]
Investment through others’ accounts in an illegal way.
Site
Lottery Scam
Sniffer Attacks
Description
The attackers take control of communication between
nodes and networks, alias man-in-the-middle attacks.
Access-driven attacks
Trace-driven attacks
An advanced type of Internet fraud where you get an
unexpected e-mail explaining that you won a huge
amount to attract victims.
Using stolen information from someone’s credit card to
perform a transaction.
Making a fake or copy of original items.
Criminal activities performed online: attackers may get
someone’s personal information, credit card data, or
anything else private in an illegal way.
Capturing network packets and interrupting network
prot…
Purchase answer to see full
attachment