This excerpt is from the Rough Cuts version of the book and may not represent the final version of this material.
This chapter covers the following:
- Various Network IPS traffic analysis methods
- Various Network Evasion Attacks
- Choosing the appropriate anti-evasion countermeasures
This chapter first explores various techniques to analyze network traffic to optimally detect suspicious and malicious traffic. This will be followed by a deep dive into the IPS Sensor software architecture. The next section discusses various evasion methods used by attackers to evade detection. The chapter concludes with a look at the appropriate and common anti-evasive countermeasures the Cisco IPS engines use to avoid false negatives.
Overview
Cisco and Third Party IPS sensors use a variety of techniques to analyze network traffic to optimally detect suspicious and malicious traffic. This chapter will cover the methods the Cisco IPS supports and the various evasion techniques used by attackers.
Chapter 3 begins with the "Network IPS Traffic Analysis Methods" section, which is a high level overview of the various analysis methods available today. Following the analysis methods, the chapter examines the evasion techniques and how to stay in front of the threats being seen around the world with anti-evasive countermeasures to prevent these evasive possibilities.
“Do I Know This Already?” Quiz
The “Do I Know This Already?” quiz allows you to assess if you should read the entire chapter. If you miss no more than one of these 8 self-assessment questions, you might want to move ahead to the "Exam Preparation Tasks." Table 3-1 lists the major headings in this chapter and the “Do I Know This Already?” quiz questions covering the material in those headings so you can assess your knowledge of these specific areas. The answers to the “Do I Know This Already?” quiz appear in Appendix A.
Table 3-1 “Do I Know This Already?” Foundation Topics Section-to-Question Mapping
|
Foundation Topics Section |
Questions |
|
Network IPS Traffic Analysis Methods |
|
|
Network IPS Evasion Attacks |
|
|
Cisco IPS Anti-Evasive Countermeasures |
|
- Which of the following is a common limitation of packet header matching as a method of IPS traffic analysis?
- true positive
- true negative
- false positive
- false negative
- Which of the following is NOT a limitation of stateful content matching as a method of IPS traffic analysis?
- performance impact
- false negatives if search is limited
- true positives due to lack of context
- false positives due to lack of context
- Which of the following are benefits of using Protocol Decoding as a method of IPS traffic analysis?
- reliably detect known application-layer attacks
- detect yet-unknown application-layer attacks through application-layer protocol verification
- lower false positives
- improved performance for application-layer analysis
- e. All of the above
- Which of the following network IPS traffic analysis method is the most granular method?
- protocol decoding
- stateful content matching
- packet content matching
- packet header matching
- Which of the following attacks is mainly detected through the IPS traffic analysis method known as traffic correlation?
- Denial of Service (DoS) attacks
- Reconnaissance attacks
- Application-layer attacks
- Composite attacks
- Which of the following IPS evasion techiniques is where the attacker splits malicious traffic, hoping to avoid detection or filtering?
- traffic fragmentation
- traffic substitution and insertion
- protocol-level misinterpretation
- encryption and tunneling
- Which of the following unicode decoding is often referred to as a worst-case scenario when utilized?
- Ambiguous bits
- Alternate code pages
- Multiple directory delimiters
- Double Encoding
- Which of the following IPS evasion techniques causes the IPS sensor to NOT ignore traffic that should be ignored?
- traffic fragmentation
- traffic substituion and insertion
- protocol-level misinterpretation
- encryption and tunneling
- Which of the following are examples of secure sessions used in encryption and tunneling?
- Secure Socket Layer (SSL)
- Secure Shell (SSH)
- Site-to-Site IP Security (IPSec) virtual private network (VPN) tunnel
- Client-to-LAN IPSec tunnel
- All of the above
- Which of the following Cisco IPS Anti-Evasion features is more suitable against Resource Exhaustion?
- Smart dynamic event summarization
- full session reassembly
- Data Normalization (deobfuscation)
- IP TTL & TCP checksum validation
***Link: Network IPS Traffic Analysis Methods
False positives with malware identification is a common limitation of packet header matching.
***Link: Network IPS Traffic Analysis Methods
A known limitation of stateful content matching is false positives due to lack of context.
***Link: Network IPS Traffic Analysis Methods
All of the listed options are benefits of Protocol Decoding as a method of IPS traffic analysis.
***Link: Network IPS Traffic Analysis Methods
The most granular method of IPS traffic analysis is protocol decoding.
***Link: Network IPS Traffic Analysis Methods
Reconnaissance attacks are the attacks mainly detected through the method of traffic analysis known as traffic correlation.
***Link: Network IPS Evasion Techiniques
The IPS evasion technique where the attacker splits malicious traffic in an effort to avoid detection or filtering is known as traffic fragmentation.
***Link: Network IPS Evasion Techiniques
When Double Encoding is utilized this is the worst-case scenario with regard to unique ways a single character can be encoded.
***Link: Network IPS Evasion Techiniques
The IPS evasion technique that causes the IPS sensor to NOT ignore traffic that should be ignored is protocol-level misinterpretation.
***Link: Network IPS Evasion Techiniques
TBD.
***Link: Network IPS Evasion Techiniques
TBD.