System and method for host and network based intrusion detection and response

• US 7,134,141 B2
• Filed: 06/12/2001
• Issued: 11/07/2006
• Est. Priority Date: 06/12/2000
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Kuperman, Benjamin, Crosbie, Mark, Shepley, Rosemarie, Frayman, Leonard L.
• Primary Examiner(s): Moazzami, Nasser
• Assistant Examiner(s): PARTHASARATHY, PRAMILA
• Application Number:
  US09/878,319
• Publication Number:
  US 20020046275A1
• Time in Patent Office: 1,974 Days
• Field of Search: 709/224, 707/205, 726/23
• US Class Current: 726/23
• CPC Class Codes: G06F 21/552 involving long-term monitoring or reporting
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: Y10S 707/99953 Recoverability
• CPC Class Codes: Y10S 707/99956 File allocation

Abstract

The present application is directed to a host-based IDS on an HP-UX intrusion detection system that enhances local host-level security within the network. It should be understood that the present invention is also usable on, for example, Eglinux, solaris, aix windows 2000 operating systems. It does this by automatically monitoring each configured host system within the network for possible signs of unwanted and potentially damaging intrusions. If successful, such intrusions could lead to the loss of availability of key systems or could compromise system integrity.

Claims

1. A method of detecting intrusions using a host-based intrusion system, comprising:

reading kernel records;

reformatting each of the read kernel records into a different format, wherein the different format is a memory mapped file; and

parsing the records and comparing the parsed records against one or more templates.

2. The method of claim 1, wherein the kernel records include kernel audit logs.

3. The method of claim 2, wherein the kernel audit logs includes information about each system call.

4. The method of claim 1, comprising monitoring system log files.

5. The method of claim 1, comprising a system call.

6. The method of claim 1, wherein the system call was initiated by a library call.

7. The method of claim 3, comprising storing each system call in a circular buffer.

8. The method of claim 1, comprising determining that an intrusion has occurred and generating an alert message.

9. The method of claim 1, comprising encrypting information sent between the host-based intrusion system and a network.

10. The method of claim 1, comprising displaying an alert message that an intrusion has occurred.

11. The method of claim 4, comprising converting the system log files into an ASCII format for comparison against the one or more templates.

12. The method of claim 2, comprising converting the kernel records into an ASCII format for comparison against the one or more templates.

13. The method of claim 1, wherein the one or more templates is a modification of files/directories template.

14. The method of claim 1, wherein the one or more templates is a change to log files template.

15. The method of claim 1, wherein the one or more templates is a SetUID files template.

16. The method of claim 1, wherein the one or more templates is a creation of world-writables template.

17. The method of claim 1, wherein the one or more templates is a repeated failed logins template.

18. The method of claim 1, wherein the one or more templates is a repeated failed SU commands template.

19. The method of claim 1, wherein the one or more templates is a race conditions attack template.

20. The method of claim 1, wherein the one or more templates is a buffer overflow attacks template.

21. The method of claim 1, wherein the one or more templates is a modification of another user'"'"'s file template.

22. The method of claim 1, wherein the one or more templates is a monitor for the start of interactive sessions template.

23. The method of claim 1, wherein the one or more templates is a monitor logins/logouts template.

24. The method of claim 1, wherein the one or more templates is chosen from the group including:

a modification of files/directories template;

a change to log files template;

a SetUID files template;

a creation of world-writables template;

a repeated failed logins template;

a repeated failed SU commands template;

a race conditions attack template;

a buffer overflow attacks template;

a modification of another user'"'"'s file template;

a monitor for the start of interactive sessions template; and

a monitor logins/logouts template.

25. The method of claim 1, wherein the kernel records are read from different computers.

26. The method of claim 1, wherein parsed records are compared against the one or more templates using at least one correlator.

27. The method of claim 1, wherein said parsing step compares the parsed records against the one or more templates simultaneously.

28. A method of detecting changes to critical files/directories, comprising:

monitoring a predetermined set of files for modifications;

monitoring a predetermined set of directories for modifications;

generating an alert for each occurrence of a modification of a monitored file, wherein if a directory is specifically excluded and a file in the specifically excluded directory is specifically included then the file is monitored, and wherein the predetermined set of files includes a system kernel file and system kernel configuration files; and

generating an alert for each occurrence of a modification of a monitored directory.

29. The method of claim 28, comprising:

determining which files to monitor of all files on a computer to form the predetermined set of files;

determining which directories to monitor of all directories on a computer to form the predetermined set of directories.

30. The method of claim 28, comprising, for each said determining step, specifically including a file or directory, specifically excluding a file or directory, or not specifically including or excluding a file or directory.

31. The method of claim 28, wherein a file or directory which is not specifically included or excluded is monitored.

32. The method of claim 28, wherein the predetermined set of files includes /stand/vmunix, /stand/kernel and /stand/bootconf.

33. The method of claim 28, wherein the predetermined set of files includes files defining the users on a system and files used to create accounts.

34. The method of claim 28, wherein the predetermined set of files includes /etc/passwd and /etc/group.

35. The method of claim 28, wherein the predetermined set of files includes files which control what network services are running and which controls programs used to fulfill service requests.

36. The method of claim 28, wherein the predetermined set of files includes /etc/inetd.conf.

37. The method of claim 28, wherein the predetermined set of files includes files which are used to control the remote access of the user root without requiring a password.

38. The method of claim 28, wherein the predetermined set of files includes /.rhosts and /.shosts.

39. The method of claim 28, wherein the set of files specifically excluded includes temporary files created by a program view.

40. The method of claim 28, wherein the predetermined set of directories includes /bin, /sbin and /usr/bin.