Intrusion Detection with SNORT: Advanced Ids Techniques Using Snort, Apache, Mysql, Php, And Acid

Paperback | May 8, 2003

byRafeeq Ur Rehman

not yet rated|write a review
Preface Security is a big issue for all networks in today's enterprise environment. Hackers and intruders have made many successful attempts to bring down high-profile company networks and web services. Many methods have been developed to secure the network infrastructure and communication over the Internet, among them the use of firewalls, encryption, and virtual private networks. Intrusion detection is a relatively new addition to such techniques. Intrusion detection methods started appearing in the last few years. Using intrusion detection methods, you can collect and use information from known types of attacks and find out if someone is trying to attack your network or particular hosts. The information collected this way can be used to harden your network security, as well as for legal purposes. Both commercial and open source products are now available for this purpose. Many vulnerability assessment tools are also available in the market that can be used to assess different types of security holes present in your network. A comprehensive security system consists of multiple tools, including: Firewalls that are used to block unwanted incoming as well as outgoing traffic of data. There is a range of firewall products available in the market both in Open Source and commercial products. Most popular commercial firewall products are from Checkpoint , Cisco and Netscreen . The most popular Open Source firewall is the Netfilter/Iptables-based firewall. Intrusion detection systems IDS that are used to find out if someone has gotten into or is trying to get into your network. The most popular IDS is Snort. Vulnerability assessment tools that are used to find and plug security holes present in your network. Information collected from vulnerability assessment tools is used to set rules on firewalls so that these security holes are safeguarded from malicious Internet users. There are many vulnerability assessment tools including Nmap and Nessus. These tools can work together and exchange information with each other. Some products provide complete systems consisting of all of these products bundled together. Snort is an open source Network Intrusion Detection System NIDS which is available free of cost. NIDS is the type of Intrusion Detection System IDS that is used for scanning data flowing on the network. There are also host-based intrusion detection systems, which are installed on a particular host and detect attacks targeted to that host only. Although all intrusion detection methods are still new, Snort is ranked among the top quality systems available today. The book starts with an introduction to intrusion detection and related terminology. You will learn installation and management of Snort as well as other products that work with Snort. These products include MySQL database and Analysis Control for Intrusion Database ACID . Snort has the capability to log data collected such as alerts and other log messages to a database. MySQL is used as the database engine where all of this data is stored. Using Apache web server and ACID, you can analyze this data. A combination of Snort, Apache, MySQL, and ACID makes it possible to log the intrusion detection data into a database and then view and analyze it later, using a web interface. This book is organized in such a way that the reader will be able to build a complete intrusion detection system by going through the following chapters in a step-by-step manner. All steps of installing and integrating different tools are explained in the book as outlined below. Chapter 2 provides basic information about how to build and install Snort itself. Using the basic installation and default rules, you will be able to get a working IDS. You will be able to create log files that show intrusion activity. Chapter 3 provides information about Snort rules, different parts of Snort rules and how to write your own rules according to your environment and needs. This chapter is very important, as writing good rules is the key to building a detection system. The chapter also explains different rules that are part of Snort distribution. Chapter 4 is about input and output plug-ins. Plug-ins are parts of the software that are compiled with Snort and are used to modify input or output of the Snort detection engine. Input plug-ins prepare captured data packets before the actual detection process is applied on these packets. Output plug-ins format output to be used for a particular purpose. For example, an output plug-in can convert the detection data to a Simple Network Management Protocol SNMP trap. Another output plug-in is used to log Snort output data into databases. This chapter provides a comprehensive overview of how these plug-ins are configured and used. Chapter 5 provides information about using MySQL database with Snort. MySQL plug-in enables Snort to log data into the database to be used in the analysis later on. In this chapter you will find information about how to create a database in MySQL, configure a database plug-in, and log data to the database. Chapter 6 describes ACID, how to use it to get data from the database you configured in Chapter 5, and how to display it using Apache web server. ACID is a very important tool that provides rich data analysis capabilities. You can find frequency of attacks, classify different attacks, view the source of these attacks and so on. ACID uses PHP Pretty Home Page scripting language, graphic display library GD library and PHPLOT, which is a tool to draw graphs. A combination of all of these results in web pages that display, analyze and graph data stored in the MySQL database. Chapter 7 is devoted to information about some other useful tools that can be used with Snort.

Pricing and Purchase Info

$40.75 online
$46.99 list price (save 13%)
In stock online
Ships free on orders over $25

From the Publisher

Preface Security is a big issue for all networks in today's enterprise environment. Hackers and intruders have made many successful attempts to bring down high-profile company networks and web services. Many methods have been developed to secure the network infrastructure and communication over the Internet, among them the use of firew...

From the Jacket

Protect your network with Snort: the high-performance, open source IDS Snort gives network administrators an open source intrusion detection system that outperforms proprietary alternatives. Now, Rafeeq Ur Rehman explains and simplifies every aspect of deploying and managing Snort in your network. You'll discover how to monitor all...

RAFEEQ UR REHMAN is founding director of Argus Network Security Services, Inc. He is an HP Certified System Administrator and CCNA with more than nine years' experience in UNIX and network administration, as well as C and database programming. His books include The Linux Development Platform; Solaris 8 Training Guide (310-043): Network...
Format:PaperbackDimensions:288 pages, 9.1 × 7 × 0.7 inPublished:May 8, 2003Publisher:Pearson EducationLanguage:English

The following ISBNs are associated with this title:

ISBN - 10:0131407333

ISBN - 13:9780131407336

Customer Reviews of Intrusion Detection with SNORT: Advanced Ids Techniques Using Snort, Apache, Mysql, Php, And Acid

Reviews

Extra Content

From the Author

PrefaceSecurity is a big issue for all networks in today’s enterprise environment. Hackers and intruders have made many successful attempts to bring down highprofile company networks and web services. Many methods have been developed to secure the network infrastructure and communication over the Internet, among them the use of firewalls, encryption, and virtual private networks. Intrusion detection is a relatively new addition to such techniques. Intrusion detection methods started appearing in the last few years. Using intrusion detection methods, you can collect and use information from known types of attacks and find out if someone is trying to attack your network or particular hosts. The information collected this way can be used to harden your network security, as well as for legal purposes. Both commercial and open source products are now available for this purpose. Many vulnerability assessment tools are also available in the market that can be used to assess different types of security holes present in your network. A comprehensive security system consists of multiple tools, including: Firewalls that are used to block unwanted incoming as well as outgoing traffic of data. There is a range of firewall products available in the market both in Open Source and commercial products. Most popular commercial firewall products are from Checkpoint , Cisco and Netscreen . The most popular Open Source firewall is the Netfilter/Iptablesbased firewall. Intrusion detection systems (IDS) that are used to find out if someone has gotten into or is trying to get into your network. The most popular IDS is Snort. Vulnerability assessment tools that are used to find and plug security holes present in your network. Information collected from vulnerability assessment tools is used to set rules on firewalls so that these security holes are safeguarded from malicious Internet users. There are many vulnerability assessment tools including Nmap and Nessus.These tools can work together and exchange information with each other. Some products provide complete systems consisting of all of these products bundled together.Snort is an open source Network Intrusion Detection System (NIDS) which is available free of cost. NIDS is the type of Intrusion Detection System (IDS) that is used for scanning data flowing on the network. There are also hostbased intrusion detection systems, which are installed on a particular host and detect attacks targeted to that host only. Although all intrusion detection methods are still new, Snort is ranked among the top quality systems available today.The book starts with an introduction to intrusion detection and related terminology. You will learn installation and management of Snort as well as other products that work with Snort. These products include MySQL database and Analysis Control for Intrusion Database (ACID). Snort has the capability to log data collected (such as alerts and other log messages) to a database. MySQL is used as the database engine where all of this data is stored. Using Apache web server and ACID, you can analyze this data. A combination of Snort, Apache, MySQL, and ACID makes it possible to log the intrusion detection data into a database and then view and analyze it later, using a web interface.This book is organized in such a way that the reader will be able to build a complete intrusion detection system by going through the following chapters in a stepbystep manner. All steps of installing and integrating different tools are explained in the book as outlined below.Chapter 2 provides basic information about how to build and install Snort itself. Using the basic installation and default rules, you will be able to get a working IDS. You will be able to create log files that show intrusion activity.Chapter 3 provides information about Snort rules, different parts of Snort rules and how to write your own rules according to your environment and needs. This chapter is very important, as writing good rules is the key to building a detection system. The chapter also explains different rules that are part of Snort distribution.Chapter 4 is about input and output plugins. Plugins are parts of the software that are compiled with Snort and are used to modify input or output of the Snort detection engine. Input plugins prepare captured data packets before the actual detection process is applied on these packets. Output plugins format output to be used for a particular purpose. For example, an output plugin can convert the detection data to a Simple Network Management Protocol (SNMP) trap. Another output plugin is used to log Snort output data into databases. This chapter provides a comprehensive overview of how these plugins are configured and used.Chapter 5 provides information about using MySQL database with Snort. MySQL plugin enables Snort to log data into the database to be used in the analysis later on. In this chapter you will find information about how to create a database in MySQL, configure a database plugin, and log data to the database.Chapter 6 describes ACID, how to use it to get data from the database you configured in Chapter 5, and how to display it using Apache web server. ACID is a very important tool that provides rich data analysis capabilities. You can find frequency of attacks, classify different attacks, view the source of these attacks and so on. ACID uses PHP (Pretty Home Page) scripting language, graphic display library (GD library) and PHPLOT, which is a tool to draw graphs. A combination of all of these results in web pages that display, analyze and graph data stored in the MySQL database.Chapter 7 is devoted to information about some other useful tools that can be used with Snort.

Read from the Book

Preface Security is a big issue for all networks in today's enterprise environment. Hackers and intruders have made many successful attempts to bring down high-profile company networks and web services. Many methods have been developed to secure the network infrastructure and communication over the Internet, among them the use of firewalls, encryption, and virtual private networks. Intrusion detection is a relatively new addition to such techniques. Intrusion detection methods started appearing in the last few years. Using intrusion detection methods, you can collect and use information from known types of attacks and find out if someone is trying to attack your network or particular hosts. The information collected this way can be used to harden your network security, as well as for legal purposes. Both commercial and open source products are now available for this purpose. Many vulnerability assessment tools are also available in the market that can be used to assess different types of security holes present in your network. A comprehensive security system consists of multiple tools, including: Firewalls that are used to block unwanted incoming as well as outgoing traffic of data. There is a range of firewall products available in the market both in Open Source and commercial products. Most popular commercial firewall products are from Checkpoint , Cisco and Netscreen . The most popular Open Source firewall is the Netfilter/Iptables-based firewall. Intrusion detection systems (IDS) that are used to find out if someone has gotten into or is trying to get into your network. The most popular IDS is Snort. Vulnerability assessment tools that are used to find and plug security holes present in your network. Information collected from vulnerability assessment tools is used to set rules on firewalls so that these security holes are safeguarded from malicious Internet users. There are many vulnerability assessment tools including Nmap and Nessus. These tools can work together and exchange information with each other. Some products provide complete systems consisting of all of these products bundled together. Snort is an open source Network Intrusion Detection System (NIDS) which is available free of cost. NIDS is the type of Intrusion Detection System (IDS) that is used for scanning data flowing on the network. There are also host-based intrusion detection systems, which are installed on a particular host and detect attacks targeted to that host only. Although all intrusion detection methods are still new, Snort is ranked among the top quality systems available today. The book starts with an introduction to intrusion detection and related terminology. You will learn installation and management of Snort as well as other products that work with Snort. These products include MySQL database and Analysis Control for Intrusion Database (ACID). Snort has the capability to log data collected (such as alerts and other log messages) to a database. MySQL is used as the database engine where all of this data is stored. Using Apache web server and ACID, you can analyze this data. A combination of Snort, Apache, MySQL, and ACID makes it possible to log the intrusion detection data into a database and then view and analyze it later, using a web interface. This book is organized in such a way that the reader will be able to build a complete intrusion detection system by going through the following chapters in a step-by-step manner. All steps of installing and integrating different tools are explained in the book as outlined below. Chapter 2 provides basic information about how to build and install Snort itself. Using the basic installation and default rules, you will be able to get a working IDS. You will be able to create log files that show intrusion activity. Chapter 3 provides information about Snort rules, different parts of Snort rules and how to write your own rules according to your environment and needs. This chapter is very important, as writing good rules is the key to building a detection system. The chapter also explains different rules that are part of Snort distribution. Chapter 4 is about input and output plug-ins. Plug-ins are parts of the software that are compiled with Snort and are used to modify input or output of the Snort detection engine. Input plug-ins prepare captured data packets before the actual detection process is applied on these packets. Output plug-ins format output to be used for a particular purpose. For example, an output plug-in can convert the detection data to a Simple Network Management Protocol (SNMP) trap. Another output plug-in is used to log Snort output data into databases. This chapter provides a comprehensive overview of how these plug-ins are configured and used. Chapter 5 provides information about using MySQL database with Snort. MySQL plug-in enables Snort to log data into the database to be used in the analysis later on. In this chapter you will find information about how to create a database in MySQL, configure a database plug-in, and log data to the database. Chapter 6 describes ACID, how to use it to get data from the database you configured in Chapter 5, and how to display it using Apache web server. ACID is a very important tool that provides rich data analysis capabilities. You can find frequency of attacks, classify different attacks, view the source of these attacks and so on. ACID uses PHP (Pretty Home Page) scripting language, graphic display library (GD library) and PHPLOT, which is a tool to draw graphs. A combination of all of these results in web pages that display, analyze and graph data stored in the MySQL database. Chapter 7 is devoted to information about some other useful tools that can be used with Snort.

Table of Contents



1. Introduction to Intrusion Detection and Snort.

What is Intrusion Detection? IDS Policy. Components of Snort. Dealing with Switches. TCP Stream Follow Up. Supported Platforms. How to Protect IDS Itself. References.



2. Installing Snort and Getting Started.

Snort Installation Scenarios. Installing Snort. Running Snort on Multiple Network Interfaces. Snort Command Line Options. Step-By-Step Procedure to Compile and Install Snort From Source Code. Location of Snort Files. Snort Modes. Snort Alert Modes. Running Snort in Stealth Mode. References.



3. Working with Snort Rules.

TCP/IP Network Layers. The First Bad Rule. CIDR. Structure of a Rule. Rule Headers. Rule Options. The Snort Configuration File. Order of Rules Based upon Action. Automatically Updating Snort Rules. Default Snort Rules and Classes. Sample Default Rules. Writing Good Rules. References.



4. Plugins, Preprocessors and Output Modules.

Preprocessors. Output Modules. Using BPF Fileters. References.



5. Using Snort with MySQL.

Making Snort Work with MySQL. Secure Logging to Remote Databases Securely Using Stunnel. Snort Database Maintenance. References.



6. Using ACID and SnortSnarf with Snort.

What is ACID? Installation and Configuration. Using ACID. SnortSnarf. Barnyard. References.



7. Miscellaneous Tools.

SnortSam. IDS Policy Manager. Securing the ACID Web Console. Easy IDS. References.



Appendix A: Introduction to tcpdump.


Appendix B: Getting Started with MySQL.


Appendix C: Packet Header Formats.


Appendix D: Glossary.


Appendix E: SNML DTD.


Index.