- Traditional IDS and IPS provide excellent
application layer attack detection capabilities.
However, they do have a weakness.
For example, they cannot detect DDoS attacks
where the attacker uses valid packets.
IDS and IPS devices are optimized for signature-based,
or rule-based application layer attack detection.
Another weakness is that these systems utilize
specific signatures to identify malicious patterns.
Yet, if a new threat appears on the network before
a signature is created to identify the traffic,
it could lead to false negatives.
An attack for which there is no signature is called
a zero day attack.
Although some IPS devices do offer anomaly-based
capabilities, which are required to detect such attacks,
they need extensive manual tuning and have
a major risk of generating false positives.
You can use more elaborate anomaly-based detection
systems to mitigate DDoS attacks and zero day outbreaks.
Typically an anomaly detection system monitors network
traffic, and alerts, or reacts to, any sudden
increase in traffic and any other abnormalities.
You can also use NetFlow as an anomaly detection tool.
NetFlow is a Cisco proprietary protocol that provides
detailed reporting and monitoring of IP traffic flows
through a network device, such as a router switch
or a Cisco firewall.
With anomaly-based analysis, the different practice
keeps track of network traffic
that diverges from the normal behavior patterns.
This practice is called anomaly-based analysis.
The limitation is that, what is considered to be
normal must be defined.
Systems and applications whose behavior can be
easily considered as normal, could be
classified as heuristic-based systems.
However, sometimes it is challenging to classify a specific
behavior as normal, or abnormal, based on different factors,
which include, negotiated protocols and ports,
specific application changes, changes in the
architecture of the network.
A variation of this type of analysis is called
profile-based detection.
This allows systems to orchestrate their alarms
on alerts in the way that other systems or end users
interrelate on the network.
Another kind of anomaly-based detection
is protocol-based detection.
This scheme is related to,
but not to be confused with, the protocol decode method.
The protocol-based detection technique depends
on well-defined protocols as opposed
to protocol decode method, which classifies as an anomaly,
any unpredicted value, or configuration
within a field in the respective protocol.
For example, a buffer overflow can be detected when
specific strings are identified
within the payload of the inspected IP packets.