|
|
 |
 | |
| thor.ps.gz | ||
 |
Intrusion Detection (ID) is the process of monitoring and collecting
system and network information in order to determine if an attack or
intrusion has occurred. The problem in ID is that the methods are not
perfect and Intrusion Detection Systems (IDS) might miss attacks or report
false alarms. To analyze IDSes, I specified, designed, and implemented a tool called Thor that automatically launches attacks and collects the alarms, reported back from them. Thor uses variations of attacks to make more precise statements about the detection capabilities of an IDS. An important feature of Thor is the possibility of autonomously trying to evade IDSes by varying attacks. To more reliably detect attacks and incrase the coverage of detected attacks, more than one IDS can be installed in a production environment. Multiple heterogeneous systems will more adequately detect possible attacks. To correlate the alarms from the different IDSes is an important issue in ongoing research and presents some interesting problems. One of them is to understand the reaction of different IDSes to a given attack. For this purpose, Thor can be used to generate so-called correlation tables. There are two other scenarios, where Thor can be used: First, network devices can be analyzed towards their influences on the reception of an IDS. Therefore, the attacks are routed through those devices and it is observed, what alarms the IDSes generate in comparison to the case where the devices were not present. Second, the tool can be used to assess IDSes in a production environment and see whether they are tuned correctly for that specific environment. See also IBM Research |