ossim - AlienVault

More documents

Recommendations

Info

3.2 Anomaly Detectors The ability to detect anomalies is more recent than that for patterns. In this case we do not have to tell the detection system what is good and what is bad; it can learn on its own and alert us when behavior deviates enough from what it has learned is normal. Since the two processes work in opposite ways, this new functionality provides a point of view that is both different and complementary to pattern detection. Anomaly detection can be especially useful for preventing, for example, perimeter attacks, which are one continuous anomaly: in the direction of the communications and the path they define, in the flow of data, in their size, duration, time, content, etc. This technique provides a solution—until now beyond reach—for controlling access of privileged users, as in internal attacks by, for example, disloyal employees, in which no policies are violated and no exploits carried out. Yet they represent an anomaly in the use and manner of use of a service. Now let's look at some other examples in which these detectors would be useful: • A new attack for which there still are no signatures could produce an obvious anomaly yet circumvent pattern detection systems. • A worm that has been introduced into the organization, a spamming attack, and even the use of P2P programs would generate a number of anomalous connections that are easy to detect. • We could likewise detect: o Use of services that is abnormal in origin and destination o Use at abnormal times o Excess use of traffic or connections o Abnormal copying of files on the internal network o Changes in a machine's operating system o Etc. We might think that, as an undesirable byproduct, these detectors will generate a number of new alerts, amplifying our signal and making our problem worse (our objective is to limit the number of alerts). However, if we take them as additional information that complements the traditional pattern alerts, we will be able to evaluate and therefore differentiate those that could result in a higher risk situation. 12
3.3 Centralization and Normalization Normalization and centralization (or aggregation) are aimed at unifying security events from all critical systems throughout the organization in a single format on just one console. All security products normally have a capacity for centralized management using standard protocols; hence, aggregation is simple using these protocols. In OSSIM we attempt to avoid regular use of agents and instead use forms of communication that are native to systems. Normalization requires a parser or translator familiar with the types and formats of alerts coming from different detectors. We will need to organize the database and adapt the forensic console in order to homogenize processing and display of all these events. That way we will be able to observe all security events for a particular moment in time—whether they come from a router, a firewall, an IDS, or a UNIX server—on the same screen and in the same format. When we have all network events centralized in the same database, we achieve a considerably comprehensive view of what’s going on throughout the network, which, as we will see shortly, allows us to develop processes that enable us to detect more complex and widely dispersed patterns. 13
Page 1 and 2: OSSIM Open Source Security Informat
Page 3 and 4: Index Foreword ....................
Page 5 and 6: 1. Introduction 1.1. Introduction W
Page 7 and 8: 1.3. Open Source Infrastructure for
Page 9 and 10: The following table summarizes thes
Page 11: 3. Functionality In order to unders
Page 15 and 16: 3.5 Risk Assessment The importance
Page 17 and 18: 3.6.2 Correlation Methods To achiev
Page 19 and 20: 3.6.2.2 Method 2: Correlation Using
Page 21 and 22: Detection of a connect operation is
Page 23 and 24: 3.7 Monitors Although they are simp
Page 25 and 26: The control panel is our general th
Page 27 and 28: 4.2 Data Flow To give a better unde
Page 29 and 30: 4.3 Distribution Architecture OSSIM

ossim - AlienVault

Create successful ePaper yourself

Delete template?

Save as template?