Chapter 5. Tracking an Intruder on the Network

	"Beware the intentions of Uninvited Guests."
	--Samir Datt

Intruders on a network are any network administrators' worst nightmare. Survey after survey conducted by the world's most trusted organizations point indisputably to the fact that, statistically, when it comes to network breaches, it is not a matter of if my network gets breached, but a matter of when my network gets breached. Some of the famous sites and networks that have been attacked in the past include the Pentagon, NATO, White House, and so on. As a network forensics investigator, it is critical to understand ways and means of intrusion detection and prevention.

Intrusion detection/prevention systems come in a multitude of flavors. There can be a host-based IDS/IPS or network-based IDS/IPS. Host-based systems monitor activity on the host computer, whereas network-based systems monitor activity based on network traffic captures.

This chapter focuses on detecting and preventing intrusions...

Understanding Network Intrusion Detection Systems

A Network Intrusion Detection System (NIDS) is a bit like the early warning alarm sirens that we see and hear in prison escape movies. These are triggered by a predefined event (such as an attempted break in/out) that is identified by a rule set enabled by the administrator/investigator. Just like a burglar alarm in a house, the NIDS is designed to detect an intruder and issue an alert to an authorized person.

Normally, a NIDS is able to detect intrusions in the network segment that it is monitoring. The key to its effective functioning is the correct placement of the NIDS device to enable it to monitor all network traffic entering and leaving the system. One way to do this is by placing it on the network and passing mirrored traffic through it. This is done to ensure that all the network traffic passes through the NIDS device.

The NIDS will monitor all inbound and outbound traffic and identify attempted intrusions by detecting anomalous...

Understanding Network Intrusion Prevention Systems

In the earlier section, we spent considerable time understanding NIDS. This has built a solid foundation, which we will find useful when moving on toward understanding NIPS.

Unlike a NIDS, which is a passive system, a NIPS is an active system that monitors network traffic and takes immediate preemptive action when a threat is detected. Intrusions are normally followed very quickly by vulnerability exploits. These are usually in the form of a malicious injection of data into an application or service with the objective of interrupting and gaining control of a machine or application. This could result in a denial of service (disabling applications or services), misusing existing privileges (rights and permissions) or escalating them for misuse, and gaining control of systems or resources.

In the information security world, most exploits come with an expiration date. This is because the moment an exploit has been identified, software vendors...

Modes of detection

NIDS and NIPS use different methods to detect suspected intrusions. The two most common detection methods are pattern matching and anomaly detection.

Pattern matching

Intruder detection using pattern matching is also known as misuse detection or signature-based detection. Basically, this is used to detect known attacks by their patterns—this includes specific actions that happen as part of the attack or their "signatures".

This is similar to identifying criminals from the fingerprints they have left at the scene of a crime. However, to be able to accurately pinpoint the identity of the criminal who was present at the scene of the crime, we need to have his/her fingerprints available in our database. In the same fashion, we need to have the pattern or signature of possible attacks in our database before our IDS/IPS can detect such an event.

Hence, the effectiveness of an IDS that relies on pattern matching is completely dependent on the signature database. Therefore, in an...

Differentiating between NIDS and NIPS

At first sight, both the solutions seem quite similar; however, there is a clear difference in that one is a passive monitoring and detection system that limits itself to raising an alarm at an anomaly or signature match, and the other is an active prevention system that takes proactive action when detecting a malicious packet by dropping it.

Usually, a NIPS is inline (between the firewall and rest of the network) and takes proactive action based on the set of rules provided to it. In the case of a NIDS, the device/computer is usually not inline but may get mirrored traffic from a network tap or mirrored port.

The network overhead in the case of a NIPS is more than that of a NIDS.

Another issue with a NIDS is that by the time an intruder hits the system and the administrator is informed, the intruder has already infiltrated the system to a good extent, thereby making a simple situation extremely dire.

While stability is paramount in both systems, the consequences...

Using SNORT for network intrusion detection and prevention

SNORT is an open source intrusion detection/prevention system that is capable of real-time traffic analysis and packet logging. Extremely popular, SNORT is the tool of choice for the open source community. While there are a number of other NIDS and NIPS out there, we will stick to SNORT for the purposes of this section.

SNORT is available from the https://www.snort.org/ website:

It makes a lot of sense to go through the documentation available on the website as this information is updated on a fairly regular basis.

At the time of writing, SNORT is available in flavors that run on some Linux distributions as well as Windows.

The download link will guide us to the correct flavor as per our requirements:

After the download, we need to install SNORT as per the following process:

We start by agreeing to the GNU Public License (GPL) so that we can proceed with the installation of SNORT:

We then proceed to selecting the components that we need...

Summary

In this chapter, you learned about network intrusion detection and prevention systems. We also explored how each has a different role to play and the different ways in which each performs its task. We have also been exposed to SNORT, which is a very versatile tool that can be used for both packet capture and network intrusion detection and prevention. You learned the importance of creating rules for NIDS/NIPS and explored how we can use these rules to identify intruders in our network.

In the next chapter, you will learn about a very important aspect of network forensics—connecting the dots using network logs. Just as a murderer leaves traces next to the victim's body, an intruder leaves traces of his/her activity in a network's log. Hence, the importance of network logs in any investigation is paramount. The next chapter will prepare us from this perspective.