Signature Classes
CIDS signatures fall into four classes. Signatures belong to
one of the four classes, based on the type of attack the signature was designed
to detect. As discussed in Chapter 23, there are three types of attacks: Reconnaissance,
Access, and Denial of Service (DoS). Signature classes map to these three attack
types and add one additional class. The four signature classes are as
follows:
-
Reconnaissance
-
Access
-
Denial of Service
-
Informational
Reconnaissance Class Signatures
Reconnaissance class signatures are
used to detect reconnaissance attacks against your network. Before intruders can
launch an attack against your network resources, they must first map your
network and network resources. Hackers have many different tools they can use to
discover the type, location, and vulnerabilities of your network resources.
Reconnaissance class signatures trigger as a result of analyzed activity known
to be, or that could lead to, unauthorized discovery of systems, services, or
vulnerabilities. Once triggered, these alarms alert security personnel when the
sensors detect these tools are being used against your network. Common
reconnaissance techniques used by hackers and detected by reconnaissance class
signatures are as follows:
-
Ping Sweeps—Allow intruders to map the
active IP addresses on your network.
-
Port Scans–Scan for open ports on ranges
of network resources.
-
DNS Queries–Allow users and intruders to
retrieve information about the topology of your network.
Access Class Signatures
Access class signatures are used to
detect access attacks against your network systems. Access class signatures can
detect attacks that could lead to unauthorized data retrieval, system access, or
privileged escalation. Common access techniques used by hackers and detected by
access class signatures are as follows:
Denial of Service (DoS) Class Signatures
Denial of service class signatures are used to detect DoS
attacks against your network. These signatures trigger an activity used for the
disablement of a network infrastructure, systems, or services. Common DoS
techniques used by hackers and detected by DoS class signatures are as
follows:
Informational Class Signatures
Informational class signatures are
used to detect normal network activity, which, in itself, isn’t considered
malicious, but the information can be used to judge the validity of an attack,
as well as for forensic purposes. Common informational events detected by
information class signatures are as follows:
-
ICMP echo requests
-
TCP connection requests
-
UDP connections
1037 times read
|
|
|
Did you enjoy this article?
(total 0 votes)
|
Sections
Comments (0 posted)
Syndication
