It’s late at night and you’re walking to your car after attending a community event. Your car is still a block away. As you walk, you scan the scene before you. Something is just not right, you say to yourself. On the dark sidewalk ahead of you, you see two silhouettes. They are moving about, and you hear raised voices. Who are these people? You decide to cross the street to play it safe. You are practicing threat detection and avoidance. That’s the purpose of protocol anomaly detection.
President Warren G. Harding famously called for “a return to normalcy”. Though it may seem less exciting, the normal state of things is generally considered the best. That goes for networks as well. The opposite condition is when things go wrong, when they are out of spec, when something is not right with the network. Such a deviation from the normal is called an anomaly.
But how do you know what’s normal when it comes to network protocols? Thankfully, there are clear standards that tell you everything that you need to know. These are called RFCs (Requests for Comments). Steven Crocker wrote the first Request for Comment (RFC 1) in 1969. The document outlined the basic requirements for setting up connections in the ARPA network. The collaborative effort of developing RFC standards by the Internet Engineering Task Force (IETF®) continues to this day.
No matter the network protocol, there are accepted standards for its implementation. There are more than 8,000 RFCs now, and the number is growing. If you want to know the right way — the accepted way — to set up a network, it’s all there. Any network that doesn’t fit the normal parameters deserves a closer look.
Protocol anomaly detection, also known as network behavior anomaly detection (NBAD), is an approach to detecting network threats by identifying violations of RFC protocol specifications. The search for protocol anomalies is part of modern intrusion detection systems (IDS) as well as intrusion prevention systems (IPS).
According to Techopedia, the three major components of network behavior monitoring are:
The point of protocol anomaly detection is to discover anything that might not be considered normal network traffic.
The point of protocol anomaly detection is to discover anything that might not be considered normal network traffic. To do that, an IDS may include a model, or profile, for each protocol based on the RFCs. This is often referred to as the “baseline”. Establishing a baseline is the first step in detecting anomalies.
If you’re worried about the bad guys, you should always be on the lookout. Whether it’s walking down the street or protecting your home, you must be vigilant. Intrusion detection systems are like computer system burglar alarms, and protocol anomaly detection is a defense against network intruders. To make it work, your IDS needs to notify you when a threat appears.
Any activity that does not conform to the expected patterns of network protocol traffic should be flagged. These anomalies could be tied to a network monitoring team’s ticket system or to the email boxes of IT personnel. The alarms might be graded by severity or grouped into particular events. With such automation, there is also the possibility of the generation of false alarms that can overwhelm a system. The thresholds may need to be adjusted.
Monitoring a large network can mean dealing with a vast amount of data points. To handle all this data, some companies have turned to machine learning. This is part of a trend toward using the power of computing to analysis the growing volume of information in every field.
In a presentation for the 4th Annual International Cyber Security Conference 2014 at Tel Aviv University, Professor Irad Ben-Gal spoke on “Anomaly Detection by Machine Learning Tools”. He told how some researchers are even using design formatting and colors to identify suspicious websites. The same machine learning techniques can be applied to protocol anomaly detection. Expect to see more of this in the coming days.
Protocol anomaly detection is an integral part of today’s intrusion detection systems and also part of Total Uptime’s Web Application and API Protection service (WAAP). It goes beyond the simple rule-setting of earlier IDS implementations. The new approach looks for abnormal trends and unusual activity. Spectral analysis that is already being used in scientific fields such as physics or astronomy can also be applied to network traffic. Finding protocol anomalies will unmask intruders that might have gone undetected otherwise. The practice of network analysis will continue to develop along with machine learning methods. In the world of cyberspace, it pays to see the dark figures in front of you before it’s too late.
Server hardening is a necessary process. And it’s a never-ending one. From the moment you pull the machine out of the box (or create it in the virtual environment), it pays to be thinking about security. But server hardening can do more than keep your machine safe. It will help with performance, and it can […]
No one needs to explain to you the virtues of being proactive. Of course, no one can make you (or this writer) do it either. You may know that you should change the timing belt on your car every 60,000 miles or so, but it’s even easier to do nothing about it — until your […]
Imagine that a smooth operator convinces Barney Fife — the famous sheriff’s deputy on TV — to unlock a Mayberry jail cell. Barney has the keys. He has the authority. He wants to do the right thing, but he’s easily confused and manipulated. Your web browser has authority too. It can do a lot of […]
There have been plenty of zombie movies over the past few years. The plots are similar — the undead stalk the living — and the productions are generally not Oscar material. But somehow the threat hits a nerve with the general public. To illustrate a threat of a different kind, let’s come up with a […]