Scribd Logo
Upload

Welcome to Scribd!

  • 99 views

    Snort - An Network Intrusion Prevention and Detection System

    Uploaded by

    Chintan
    This document discusses Snort, an open source network intrusion prevention and detection system. It provides an overview of Snort's architecture and components, including the packet decoder, preprocessors, detection engine, and output modules. The detection engine applies rules to network packets using string matching to detect intrusions. Challenges for Snort include growing rule databases and spending significant resources on signature-based detection. Potential improvements involve offloading work to preprocessing and hardware to increase efficiency.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd

    Snort - An Network Intrusion Prevention and Detection System

    Uploaded by

    Chintan
    99 views20 pages
    This document discusses Snort, an open source network intrusion prevention and detection system. It provides an overview of Snort's architecture and components, including the packet decoder, preprocessors, detection engine, and output modules. The detection engine applies rules to network packets using string matching to detect intrusions. Challenges for Snort include growing rule databases and spending significant resources on signature-based detection. Potential improvements involve offloading work to preprocessing and hardware to increase efficiency.

    Original Description:

    This will give the information about the snort software.

    Original Title

    snort

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    This document discusses Snort, an open source network intrusion prevention and detection system. It provides an overview of Snort's architecture and components, including the packet decoder, preprocessors, detection engine, and output modules. The detection engine applies rules to network packets using string matching to detect intrusions. Challenges for Snort include growing rule databases and spending significant resources on signature-based detection. Potential improvements involve offloading work to preprocessing and hardware to increase efficiency.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    99 views20 pages

    Snort - An Network Intrusion Prevention and Detection System

    Uploaded by

    Chintan
    This document discusses Snort, an open source network intrusion prevention and detection system. It provides an overview of Snort's architecture and components, including the packet decoder, preprocessors, detection engine, and output modules. The detection engine applies rules to network packets using string matching to detect intrusions. Challenges for Snort include growing rule databases and spending significant resources on signature-based detection. Potential improvements involve offloading work to preprocessing and hardware to increase efficiency.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Download as pdf or txt
    of 20

    Snort - an network intrusion

    prevention and detection system

    Student: Yue Jiang


    Professor: Dr. Bojan Cukic
    CS665 class presentation
    Overview
     What’s snort?
     Snort architecture
     Snort components
     Detection engine and rules in snort
     Possible research works in snort.
    What’s snort?
     NIDS: A network intrusion detection system (NIDS)
    is an intrusion detection system that tries to detect
    malicious activity such as denial of service attacks, port
    scans or even attempts to crack into computers by
    monitoring network traffic.
     Snort: an open source network intrusion prevention and
    detection system. It uses a rule-based language combining
    signature, protocol and anomaly inspection methods
     Snort: the most widely deployed intrusion detection and
    prevention technology and it has become the de facto
    standard technology worldwide in the industry.
    Snort

    1. A packet sniffer: capture and display packets from


    the network with different levels of detail on the console

    2. Packet logger: log data in text file


    3. Honeypot monitor: deceiving hostile parties
    4. NIDS: network intrusion detection system
    Typical locations for snort
    Requirement of snort
     lightweight NIDS
     small, flexible
     highly capable system
    Snort architecture

    From: Nalneesh Gaur, Snort: Planning IDS for your enterprise,


    http://www.linuxjournal.com/article/4668, 2001.
    Snort components

    From: Rafeeq Ur Rehman, Intrusion Detection Systems with Snort: Advanced IDS
    Techniques with Snort, Apache, MySQL, PHP, and ACID.
    Logical components of snort
     Packet Decoder: takes packets from different types of
    network interfaces (Ethernet, SLIP,PPP…), prepare packets for
    processing

     Preprocessor: (1) prepare data for detection engine; (2)


    detect anomalies in packet headers; (3) packet defragmentation;(4)
    decode HTTP URI; (5) reassemble TCP streams.

     Detection Engine: the most important part, applies


    rules to packets

     Logging and Alerting System


     Output Modules: process alerts and logs and generate
    final output.
    TCP/IP layer

    Physical layer

    Snort work on network (IP) layer, transport (TCP/UDP) layer protocol, and application layer
    Detection Engine
    ※Things need to be done for detection engine:
    •The IP header of the packet
    •The transport layer header. TCP, UDP, ICMP etc.
    •The application layer level header. Header of DNS, FTP, SNMP, SMTP
    •Packet payload

    ※ How to do these?
    Apply rules to the packets using a Boyer-Moore string matching
    algorithm

    ※ Requirement
    1. Time critical
    2. Fast
    Detection engine
     Number of rules
     Traffic load on the network
     Speed of network and machine
     Efficiency of detection algorithm
    Rules
     In a single line
     Rules are created by known intrusion signatures.
     Usually place in snort.conf configuration file.

    rule header rule options


    Rule examples
    destination ip address
    Apply to all ip packets

    Destination port
    Source ip address

    Source port #
    Rule options

    Alert will be generated if criteria met

    Rule header
    Detection engine order to scan the
    rules

     Snort does not evaluate the rules


    in the order that they appear in
    the Snort rules file. In default, the
    order is:
    1. Alert rules
    2. Pass rules
    3. Log rules
    Challenges with snort
     Misuse detection – avoid known
    intrusions
     Rules database is larger and larger
     It continues to grow
     snort version 2.3.2, there are 2,600 rules
     80% of them are signatures
     Snort spends 80% work time to do string match

     Anomaly detection – identify new


    attacks
     Probability of detection is low
    Snort components

    From: Rafeeq Ur Rehman, Intrusion Detection Systems with Snort: Advanced IDS
    Techniques with Snort, Apache, MySQL, PHP, and ACID.
    Attempts to improve
     Increasing preprocessing
    ability --- offload partial work from detect
    engine
     Using hardware to reduce
    workload - a hybrid
    architecture --- software has more flexibility,
    hardware has relatively higher throughput
     Better detection algorithm
    Possible ways?
     Organize the well-known rules into
    better data structure to achieve
    better performance
     A detector with acceptable detection
    probability
    Thank you !

    You might also like