In addition to firewall's There are also network intrusion detection systems.
These are programs or devices that analyze data sent over the network in real time on the basis of predefined
patterns or anomalies from the baseline.
They notify the user or anonymously take preventative actions
the simplest network intrusion detection systems analyze traffic against certain characteristics some
programs create packets in a way that differs from the RAFC standard.
The foremost example of that is a Tisci piece gang called the X Max tree which has the flags in the
TCAP headers set in a nonsensical way.
No host would send packets with flags set that way.
Another example is the null scan.
In this case all of the TCAP Hetter flags are turned off network intrusion detection systems analyze
packet headers looking for anomalies thanks to that they can identify a program which an attacker used
for example to perform a scan.
Each of these programs corrupts packets in a distinctive way.
More and more network intrusion detection systems in use our intelligence systems they learn the behaviors
of the users of the network they protect a system in the learning mode collects data about the user's
activity and the network based on this.
It creates a signature.
We're not talking here about the signature in the sense of the combination of two header fields.
Rather it may include information that for example a user John Doe receives more data than he sends
the ratio of packets downloaded to the packets sent is three to one.
In addition he connects to four favorite's servers and works usually between 9:00 a.m. and 4:00 p.m.
if the same user start sending data at 11:00 p.m. downloading very little.
And in addition sending the data from a database server which is not connected to before his behavior
will be inconsistent with the characteristic calculated beforehand by the intrusion detection system.
This is how intelligent intrusion detection systems work
this functionality is developed as part of an intrusion detection system called Snorre which has become
sort of a standard
having discovered a suspicious situation.
That is a packet matching and a text signature or the one that doesn't match the user's characteristic
or network traffic signature.
The response of the detection system can be passive or active a passive response consists of recording
the attack and signaling it to the administrator an active response is more interesting in an active
response the communication channel is immediately interrupted as a result of an interference with the
TCAP session.
Previously we mentioned that more than 90 percent of the Internet traffic and traffic on local networks
uses a transport layer of TCAP because it's reliable and guarantees packet delivery.
The session can be terminated by the commands of ffin or reset discussing network intrusion detection
systems.
We should mention traps they use
such traps are called honeypots.
These are special systems run in order to attract attackers.
One of their main advantages that they are not production systems they're configured to run certain
services but in fact they do not provide any services useful for the network.
This means that any attack attempt can be easily identified.
Each connection attempt with a honeypot is suspicious.
In a perfectly configured network no one would try to find a database server by trial and error and
then connect to it to read some data each user connects to the server dedicated to a given program with
a honeypot enabled.
It's easier to analyze suspicious traffic because you don't have to filter out regular traffic each
session established with the honeypot is suspicious.
Despite numerous advantages.
Network intrusion detection systems and firewalls have their limitations.
Here's a relatively recent story.
It happened a couple of years ago which it exemplifies these limitations.
It was a four way handshake it was publicized by the Breaking Point Systems Company and the NSA slabs
Research Group.
Let's start from the very beginning.
The TCAP which is a session protocol initiates the communication through a handshake process which involves
establishing a session the RAFC 793 describes the entire process in detail should proceed as follows.
The initiator since the SYN packet in order to synchronize sequence numbers after receiving the packet
the recipient sends an acknowledgment message for a Tisci pay packet.
This means sending in a UK Flegg the recipient then sends its own synchronization packet.
Usually this flag is sent along with the previous one in a single sin a S.K. packet initiator confirms
receiving the packet by sending the HK response.
At this point only that information has been exchanged.
Both parties know the sequence numbers.
It can now reliably exchange data in Section 3.3 of the RAFC 793.
This process is described slightly different
according to the document the client initiator sends a send packet the receiver acknowledges it by sending
an AC packet then it sends it sequence number in a separate packet.
Having received the packet the initiator acknowledges that by sending a UK packet
Thus the RFE described session establishment as a four stage process it requires the exchange of four
messages rather than three issues.
The creators of firewalls and intrusion detection systems face is that their products are suited for
the current situation.
Because it's customary to establish a TCAP session using three packets only firewalls and intrusion
detection systems assume that this is the only way to establish a TCAP session the RFID standard however
is different.
Firewalls are not universal mechanisms that always act in a predictable way.
They are configured with specific situations in mind.
If someone can look at the situation from a different perspective and hackers are people who can easily
find a different perspective then the assumptions underlying the design of a device turn out to be wrong.
The entire device will prove ineffective will show that while.