Chapter 8
This intruder skill level include: hackers with minimal technical skill who use existing attack toolkits comprise the largest number of attackers are the easiest to defend against
What is Apprentice
This IDS approach involves the use of rules for identifying known penetration or penetrations that would exploit known weaknesses, rules can also be defined that identify suspicious behavior, even when the behavior is within the bounds of established patterns of usage
What is Heuristic-based approaches
The purpose of this type of format is to define data formats/exchange procedures for sharing information of interest to intrusion detection and response systems and to management systems that may need to interact with them
What is Intrusion detection exchange format
This intruder skill level include: hackers with sufficient technical skills to modify and extend attack toolkits to use newly discovered or purchased vulnerabilities may be able to locate new vulnerabilities to exploit that are similar to some already known found in all intruder classes
What is Journeymen
This intruder skill level include: hackers with high-level technical skills capable of discovering brand new categories of vulnerabilities write new attack toolkits include better known classical hackers employed by state sponsored organizations
What is Master
This IDS approach matches a large collection of known patterns of malicious data against data stored on a system or in transit over a network, where the signatures need to be large enough to minimize the false alarm rate, while still detecting a sufficiently large fraction of malicious data
What is Signature based detection
This IDS analysis approach uses a set of known malicious data patterns or attack rules that are compared to current behavior, can only identify known attacks for which it as patterns or rules is also know as misuse detection,
What is Signature/Heuristic based detection
This type of intruder is a member of an organized crime group with a goal of financial reward
What is a Cyber Criminal
This type of intruders activities may includes Identity theft theft of financial credentials corporate espionage data theft data ransoming
What is a Cyber Criminal
This Key element of the functional model includes network packets, operating system audit logs, application audit logs, and system-generated checksum data
What is a Data Source
This key element of the functional model is the raw data that an IDS uses to detect unauthorized or undesired activity.
What is a Data Source
This IDS adds a specialized layer of security software to vulnerable or sensitive systems, and can use either anomaly or signature and heuristic approaches
What is a Host-based intrusion detection system
This type of honeypot, consists of a software package that emulates particular IT services or systems well enough to provide a realistic initial interaction, but does not execute a full version of those services or system.
What is a Low Interaction Honeypot
This type of sensor is a NIC in promiscuous mode that will just listen to all network traffic, and is more efficent
What is a Passive sensor
This key element of the functional model collects data from the data source, and then forwards events to the analyzer
What is a Sensor
This type of intruder are groups of hackers sponsored by governments to conduct espionage or sabotage activities, and are also know as advanced persistent threats
What is a State-Sponsored intruder
This type of HIDS allows us to take the network into consideration, and move beyond the single host
What is a distributed HIDS
This detection system combines information from a number of sensors, often both host and network based, in a central analyzer that is able to better identify and respond to intrusion activity
What is a distributed or hybrid intrusion detection system
This type of honeypot is a real system, with a full O/S, services and applications which are instrumented and deployed where they can be accessed by attackers
What is a high interaction honeypot
This type of honeypot provides a more realistic target that may occupy an attacker for an extended period, but requires significantly more resources and if compromised could be used to initiate attacks on other systems
What is a high interaction honeypot
This decoy system is designed to lure a potential attacker away from critical systems, collection information about the attacker, and encourage the attack to stay on the system long enough for admins to respond
What is a honeypot
This system is filled with fabricated information that a legitimate user of the system wouldn't access, also the resources have no production value so, incoming communication is most likely a probe, scan or attack, and outbound communications suggests the system has been compromised
What is a honeypot
This detection system monitors the characteristics of a single host for suspicious activity
What is a host-based intrusion detection system
This type of honeypot provides a less realistic target, but is often sufficient for use as a component of a distributed IDS to warn of imminent attack
What is a low interaction honeypot
This type of IDS monitors traffic at selected points on a network, and examines traffic packet by packet in real time
What is a network based intrusion detection system
This detection system monitors network traffic and analyzes network, transport, and application protocols to identify suspicious activity
What is a network-based intrusion detection system
This type of intruder are either individuals or members of a larger group of outsider attackers who are motivated by social or political causes
What is an Activist
This type of intruder has a low skill level and the aim of their attacks is often to promote and publicize their cause typically through website defacement denial of service attacks theft and distribution of data
What is an Activist
This key element of the functional model is the ID component or process that analyzes the data collected by the sensor for signs of unauthorized or undesired activity or for events that might be of interest to the security administrator
What is an Analyzer
The disadvantage of this honeypot is that it has little or no ability to trap internal attackers.
What is an external honeypot
This type of sensor has network traffic go through the sensor and doesn't require an additional piece of hardware, just software
What is an inline sensor
The disadvantages of this honeypot is if the honeypot is compromised it can attack other internal systems.
What is an internal honeypot
This IDS analysis approach involves the collection of data relating to the behavior of legitimate users over a period of time, and current observed behavior is analyzed to determine whether this behavior is that of a legitimate user or that of an intruder
What is anomaly-based detection
A honeypot at this location can catch internal attacks, and can also detect a misconfigured firewall that forwards impermissible traffic from the internet to the internal network.
What is behind the firewall
This term is when a hardware or software function that gathers and analyzes information from various areas within a computer or a network to identify possible security intrusions
What is intrusion detection
This type of anomaly based detection use an expert system that classifies observed behavior according to a set of rules that model legitimate behavior
What is knowledge based anomaly based detection
This type of anomaly based detection automatically determine a suitable classification model from the training data using data mining techniques
What is machine-learning anomaly based detection
A honeypot that is deployed in this location is useful for tracking attempts to connect to unused IP addresses with the scope of the network, and does not increase the risk for the internal network
What is outside the external firewall
This term is the unauthorized act of bypassing the security mechanisms of a system
What is security intrusion
This type of anomaly based detection is analysis of the observed behavior using univariate, multivariate, or time-series models of observed metrics
What is statistical anomaly based detection
This key element of the functional model has functions that typically include sensor and analyzer configuration, event notification management, data consolidation, and reporting
What is the Manager
This key element of the functional model is the ID component or process from which the operator manages the various components of the IDS
What is the Manager
This key element of the functional model is the human that is the primary user of the IDS manager, and often monitors the output of the IDS and initiates or recommends further action
What is the Operator
This key element of the functional model is the human with overall responsibility for setting the security policy of the organization, and, thus, for decisions about deploying and configuring the IDS
What is the administrator