Home > Articles > Cisco Certification > CCNP > CCNP Security IPS 642-627 Official Cert Guide: Network IPS Traffic Analysis Methods, Evasion Possibilities, and Anti-evasive Countermeasures

CCNP Security IPS 642-627 Official Cert Guide: Network IPS Traffic Analysis Methods, Evasion Possibilities, and Anti-evasive Countermeasures

  • Date: Jul 18, 2011.

Contents

  1. Do I Know This Already? Quiz
  2. Foundation Topics
  3. Network IPS Evasion Techniques
  4. Summary
  5. References
  6. Exam Preparation Tasks
  7. Complete the Tables and Lists from Memory
  8. Definitions of Key Terms

Article Description

This chapter covers the various methods used for traffic analysis using a network IPS sensor, the various evasion techniques used by attackers to bypass detection & filtering while understanding the benefits and limitations of each method to assess the risk of evasion, and the various countermeasures, tools, and choosing the best approach based on the methods used by attackers.

From the Rough Cut

CCNP Security IPS 642-627 Official Cert Guide

CCNP Security IPS 642-627 Official Cert Guide

$69.99

This excerpt is from the Rough Cuts version of the book and may not represent the final version of this material.

This chapter covers the following:

  • Various Network IPS traffic analysis methods
  • Various Network Evasion Attacks
  • Choosing the appropriate anti-evasion countermeasures

This chapter first explores various techniques to analyze network traffic to optimally detect suspicious and malicious traffic. This will be followed by a deep dive into the IPS Sensor software architecture. The next section discusses various evasion methods used by attackers to evade detection. The chapter concludes with a look at the appropriate and common anti-evasive countermeasures the Cisco IPS engines use to avoid false negatives.

Overview

Cisco and Third Party IPS sensors use a variety of techniques to analyze network traffic to optimally detect suspicious and malicious traffic. This chapter will cover the methods the Cisco IPS supports and the various evasion techniques used by attackers.

Chapter 3 begins with the "Network IPS Traffic Analysis Methods" section, which is a high level overview of the various analysis methods available today. Following the analysis methods, the chapter examines the evasion techniques and how to stay in front of the threats being seen around the world with anti-evasive countermeasures to prevent these evasive possibilities.

“Do I Know This Already?” Quiz

The “Do I Know This Already?” quiz allows you to assess if you should read the entire chapter. If you miss no more than one of these 8 self-assessment questions, you might want to move ahead to the "Exam Preparation Tasks." Table 3-1 lists the major headings in this chapter and the “Do I Know This Already?” quiz questions covering the material in those headings so you can assess your knowledge of these specific areas. The answers to the “Do I Know This Already?” quiz appear in Appendix A.

Table 3-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping

Foundation Topics Section

Questions

Network IPS Traffic Analysis Methods

Network IPS Evasion Attacks

Cisco IPS Anti-Evasive Countermeasures

  1. Which of the following is a common limitation of packet header matching as a method of IPS traffic analysis?

    2. ***Link: Network IPS Traffic Analysis Methods

    1. true positive
    2. true negative
    3. false positive
    4. false negative

    False positives with malware identification is a common limitation of packet header matching.

  2. Which of the following is NOT a limitation of stateful content matching as a method of IPS traffic analysis?

    3. ***Link: Network IPS Traffic Analysis Methods

    1. performance impact
    2. false negatives if search is limited
    3. true positives due to lack of context
    4. false positives due to lack of context

    A known limitation of stateful content matching is false positives due to lack of context.

  3. Which of the following are benefits of using Protocol Decoding as a method of IPS traffic analysis?

    4. ***Link: Network IPS Traffic Analysis Methods

    1. reliably detect known application-layer attacks
    2. detect yet-unknown application-layer attacks through application-layer protocol verification
    3. lower false positives
    4. improved performance for application-layer analysis
    5. e. All of the above

    All of the listed options are benefits of Protocol Decoding as a method of IPS traffic analysis.

  4. Which of the following network IPS traffic analysis method is the most granular method?

    5. ***Link: Network IPS Traffic Analysis Methods

    1. protocol decoding
    2. stateful content matching
    3. packet content matching
    4. packet header matching

    The most granular method of IPS traffic analysis is protocol decoding.

  5. Which of the following attacks is mainly detected through the IPS traffic analysis method known as traffic correlation?

    6. ***Link: Network IPS Traffic Analysis Methods

    1. Denial of Service (DoS) attacks
    2. Reconnaissance attacks
    3. Application-layer attacks
    4. Composite attacks

    Reconnaissance attacks are the attacks mainly detected through the method of traffic analysis known as traffic correlation.

  6. Which of the following IPS evasion techiniques is where the attacker splits malicious traffic, hoping to avoid detection or filtering?

    7. ***Link: Network IPS Evasion Techiniques

    1. traffic fragmentation
    2. traffic substitution and insertion
    3. protocol-level misinterpretation
    4. encryption and tunneling

    The IPS evasion technique where the attacker splits malicious traffic in an effort to avoid detection or filtering is known as traffic fragmentation.

  7. Which of the following unicode decoding is often referred to as a worst-case scenario when utilized?

    8. ***Link: Network IPS Evasion Techiniques

    1. Ambiguous bits
    2. Alternate code pages
    3. Multiple directory delimiters
    4. Double Encoding

    When Double Encoding is utilized this is the worst-case scenario with regard to unique ways a single character can be encoded.

  8. Which of the following IPS evasion techniques causes the IPS sensor to NOT ignore traffic that should be ignored?

    9. ***Link: Network IPS Evasion Techiniques

    1. traffic fragmentation
    2. traffic substituion and insertion
    3. protocol-level misinterpretation
    4. encryption and tunneling

    The IPS evasion technique that causes the IPS sensor to NOT ignore traffic that should be ignored is protocol-level misinterpretation.

  9. Which of the following are examples of secure sessions used in encryption and tunneling?

    10. ***Link: Network IPS Evasion Techiniques

    1. Secure Socket Layer (SSL)
    2. Secure Shell (SSH)
    3. Site-to-Site IP Security (IPSec) virtual private network (VPN) tunnel
    4. Client-to-LAN IPSec tunnel
    5. All of the above

    TBD.

  10. Which of the following Cisco IPS Anti-Evasion features is more suitable against Resource Exhaustion?

    11. ***Link: Network IPS Evasion Techiniques

    1. Smart dynamic event summarization
    2. full session reassembly
    3. Data Normalization (deobfuscation)
    4. IP TTL & TCP checksum validation

    TBD.

2. Foundation Topics | Next Section

Cisco Press Promotional Mailings & Special Offers

I would like to receive exclusive offers and hear about products from Cisco Press and its family of brands. I can unsubscribe at any time.