IPS / IDS systems. Intrusion detection and prevention

Ruslan Rakhmetov, SecurityVision

In this article we will talk about detection of intrusions into the company perimeter and defence measures. To solve this problem, you can use separate products in different ‘zones’ of the company: activate a firewall on the perimeter, deploy XDR on hosts, and place traps and baits throughout the infrastructure for intruders. From the general flow of events to find clearly incidents or just anomalous (to be processed by the analytical centre). The incidents are then pieced together, and other defences are configured to prevent future intrusions. The general approach remains the same, whichever path you choose: you can use combined tools, which will be discussed in this text, you can form an ecosystem of disparate products with a single interface, or you can simply use the protection systems individually.

We should start with the intrusion detection phase: systems that can detect the behaviour of intruders can be general (Intrusion Detection System, or IDS), response-oriented (EDR/XDR and IRP/SOAR, which we have already discussed earlier) or simply analytical, where machine learning can detect an attack in a large stream of events.

Then there is the intrusion prevention phase (the relevant systems are collectively called Intrusion Prevention System, IPS), whose tasks can be performed locally, as described above, or within a single product.

There are separate products that solve only one task, but in their evolution, modern systems allow users to close the entire cycle by automating, for example, the interaction with NGFW or spam filters and thus blocking malicious activity.

Figure 1 - Evolution of intrusion detection systems

If you read our XDR solution overview, you can draw analogies in the approach: sometimes the use of separate solutions is more accurate and useful, but a single interface is simply more convenient and faster for humans. Compared to traditional defences (anti-spam, antivirus, firewall, etc.) IDS/IPS provide a much higher level of network protection, while separate defences usually do a better job. A single solution can be compared to a Swiss knife, where you can open a can of tinned food, a bottle of wine and slice bread all at once.

Such a tool is compact, quick to use, and easy to fit into a rucksack pocket. It's the same in infrastructure - when the product is one, it's more convenient to install it on a server and maintain it.

On the other hand, there will always be more advanced standalone solutions like a can opener, electric corkscrew, etc. when the capabilities of individual products are taken to the next level. In the search for balance, IPS systems have achieved synergies - precisely through speed of response and internal automation, which with classical means can be provided by SOAR products or in-house developments.

An even greater effect can be achieved by using different technologies to search for incidents and different installation methods to focus on specific vulnerabilities:

- The first way to install an IPS system is by deploying it at the perimeter (Perimeter Intrusion Detection Systems (PIDS), where traffic is collected from a specific section of the network. In such a deployment, the intrusion protection system can be an NGFW-class solution. Only if the firewall allows and denies connections according to predefined rules, intrusion detection additionally applies machine learning to search for anomalies. We will look at the individual methods of defence next, focusing on channels for now.

- A separate class of solutions for application protection has emerged among NGFW solutions (WAF), so for intrusion protection we can also focus on analysing packets transmitted via Application Protocol-based Intrusion Detection System (APIDS).

These two deployment methods can be compared to installing a turnstile either at the entrance to a metro station (protected perimeter) or at the entrance to a carriage, as on long-distance trains. In the first case, suspicious traffic can be detected in a large flow of events, and in the second case - in the interface open to users on the network, for example, when trying to access a database through an application.

The now common deployment methods are even more general:

- If the system is deployed at the network level (Network Intrusion Detection System, NIDS) and analyses all traffic (not only at the perimeter but also internally), many more unusual interactions between services can be detected and protection can be increased. The main load in such systems depends on the bandwidth and speed of the analyser. The more offices and facilities connected over the network, the more complex the installation and more expensive the equipment will be.

- Some tasks of analysing and intercepting traffic can be solved on user workstations and servers at once. This is how Host-based Intrusion Detection System (HIDS) installations work.

These two approaches can be seen in other systems that solve similar problems. In our review of DLP systems, we have already looked at two such architectures. Only instead of searching for attackers and attack vectors, the problem is data protection, and instead of analysing interactions, the content of files is analysed.

There are other, more point systems, some of which are aimed at working in a virtualisation environment (Virtual Machine-based Intrusion Detection Systems, VMIDS). Because of the architecture of virtualisation systems, it is possible to combine the accuracy and speed of HIDS, together with reduced system requirements. And, of course, hybrid systems that implement multiple approaches at once (Hybrid Intrusion Detection System, HyIDS) have emerged to maximise coverage.

To maximise the use of IDS/IPS, two scenarios can be implemented:

1. Deploy the system at a level close to the protected object. In this way, you can save traffic and limit yourself to a specific subnet or application, for example. If we compare it to public transport, we get a system with fewer turnstiles, which means it is cheaper, simpler and more convenient to work with.

2- Adapt typical settings to your infrastructure. It is easier to do this when first the traffic is just read, without blocking and direct protection. This is a kind of monitoring, for example, of the passability of different zones of the city, streets or entire regions to optimise the transport system.

Fig. 2 - Ways of realising intrusion protection

A traditional intrusion protection system consists of sensors that ‘catch’ traffic and transmit it for analysis. Different mechanisms then determine the essence of the collected data and look for incidents.

Different installation methods allow maximum data to be collected for further analysis. To understand the content of the traffic, you can use Man in the Middle mode (traffic transmission before encryption) and Deep Packet Inspection (DPI) technology.

Several technologies are used for analysis. The earliest systems used simple policies to organise protection. For example, if the amount of data is exceeded, the transmission stops or needs to be acknowledged.

Signature analysis made it possible to compare collected data with existing threat databases (usually separate databases from different vendors). It is advisable to keep the databases up-to-date, as a threat can appear more often than once a day, and the consequences can lead to large losses. The work of a signature analyser is similar to that of a hostess at the entrance to a restaurant - all guests who have booked a table should be let through and escorted to their seats, while marginal individuals should be kept out. The more complete the hostess has a list of guests, the more thoroughly it is updated - the less mistakes and dissatisfaction there will be.

Anomaly analysis allows you to calculate any unusual behaviour that could be a threat without pre-built lists and databases. For example, behavioural analysis will identify anomalies in different categories. For HIDS systems these are deviations from statistical metrics and number of actions, PIDS or NIDS will be able to find anomalies in the traffic itself or communication protocols. In this case, artificial intelligence first learns from your company's statistics and then looks for differences in similar time periods. For example, an increase in requests to an online shop during the holiday season is normal, but when compared to the same period in previous years, you can spot differences and detect a threat. Without machine learning, an incident could have been detected in normal activity as well, when the number of requests from genuine users is simply not thought of in advance.

Infrastructure intrusion attempts can be detected in a variety of ways: in network traffic, port activity, data transmitted over monitored protocols, and even on endpoint devices. Depending on the installation method and analysis techniques, IDS systems can detect (and IPS can prevent) malware, botnet attacks, various attempts to access data, and violations of security policies and rules defined on network defences. By controlling from a single interface, a task similar to the application of separate protection systems united by an orchestration tool is achieved. Nevertheless, such products have not become a panacea - the more systems can be assembled into a common ecosystem, the better, because the most complex and cunning attacks are realised at the junction of individual products.

* IDS (Intrusion Detection Systems) - what they are.

Intrusion Detection Systems (IDS) are specialised software or hardware devices designed to monitor and analyse network traffic in order to detect attempts of unauthorised access or intrusion into computer systems and networks. Their main task is the early detection of potential security threats, which enables rapid response and prevention of serious incidents.

How do IDSs work?

IDSs operate based on predefined rules and signatures that describe normal network behaviour and potentially dangerous activities. When an IDS detects a deviation from the established norms, it triggers and generates an alert or automatic actions, such as blocking access for a potential intruder.

There are two main types of intrusion detection systems:

1. Network-based IDS (NIDS): These IDSs analyse real-time traffic and look for anomalies in network activity. They can detect different types of attacks such as port scanning, network injection and application level attacks.

2. Host-based IDS (HIDS): These IDSs are installed directly on a computer or server and monitor the activity of that particular device. They are able to detect unauthorised access to files and applications on the host.

Why IDSs are important.

IDSs play a key role in information security for several reasons:

1. Early threat detection: IDSs can detect intrusion attempts at the earliest stages, reducing the risk of successful attacks.

2. Protection against a variety of attacks: IDSs can detect a variety of attacks, including known and emerging threats.

3. Network monitoring: IDSs provide valuable information about how the network is being used and what threats may be affecting it. 4.

4. Security Compliance: Multiple regulatory bodies and standards require IDSs to secure data and networks.

* IPS (Intrusion Prevention Systems) - What it is.

An Intrusion Prevention System (IPS) is a comprehensive software or hardware solution designed to detect and block unauthorised activity on computer networks and systems. It works at the data packet level, analysing all network traffic to identify suspicious activity or attacks.

How do intrusion prevention systems work?

Intrusion prevention systems are mainly based on signature-based and anomaly-based traffic analysis. Let's take a closer look at both methods:

1. Signature Analysis: This method uses a database of known attacks and threats. IPS compares current network traffic against this database and blocks data packets that match predefined signatures. This allows it to detect and block known attacks such as viruses, worms, and DDoS attacks.

2- Anomaly Analysis: This method analyses normal network behaviour and detects anomalies or unusual patterns. If IPS detects unauthorised activity that does not conform to normal network behaviour, it triggers and blocks the activity. This method is useful for detecting new and unknown attacks.

Benefits of Intrusion Prevention Systems

-Protection automation: IPS is able to automatically block attacks, minimising the risk of human error and speeding up the response to threats.

-Detection of unknown threats: Through anomalous analysis, IPS can detect new and unknown attacks, making it an effective tool to combat zero-days.

-Reduce business risk: Protecting networks and data from cyberattacks helps reduce potential financial losses and preserve a company's reputation.