a nalysis c onsole for i ntrusion d atabases
DESCRIPTION
A nalysis C onsole for I ntrusion D atabases. Roy. Description. ACID. Objective. Setup ACID, MySQL, Snort Super alert Analyzer Performance Benchmarking of ACID. About ACID. Query-builder and search interface. Chart and statistics generation. Packet viewer (decoder). Alert management. - PowerPoint PPT PresentationTRANSCRIPT
AAnalysis nalysis CConsole for onsole for IIntrusion ntrusion DDatabases atabases
RoyRoy
DescriptionDescription
ACID
ObjectiveObjective
Setup ACID, MySQL, SnortSetup ACID, MySQL, Snort Super alert AnalyzerSuper alert Analyzer Performance Benchmarking of ACIDPerformance Benchmarking of ACID
About ACIDAbout ACID
Query-builder and search interface
Packet viewer (decoder) Alert
management
Chart and statistics generation
Centralize control
System overviewSystem overview
ACID+Snort+MySQLACID+Snort+MySQL
ACID
Distributed IDS centralize controlDistributed IDS centralize control
ACID DB
PrerequisitesPrerequisites A databaseA database
- Package: MySQL Package: MySQL • Version: 3.23.x+ Version: 3.23.x+ • Homepage: Homepage: http://www.mysql.com/http://www.mysql.com/
A mechanismA mechanism- Package: Snort Package: Snort
• Version: 1.7+ Version: 1.7+ • Homepage: Homepage: http://http://www.snort.orgwww.snort.org//
- Package: PHP Package: PHP • Version: 4.0.4+ Version: 4.0.4+ • Homepage: Homepage: http://http://www.php.netwww.php.net//
A web serverA web server- Package: Apache Server Package: Apache Server - Version: 1.3.*+ Version: 1.3.*+ - Homepage: Homepage: http://http://www.apache.orgwww.apache.org//
PHP access database APIPHP access database API- Package: ADODB Package: ADODB
• Homepage: Homepage: http://http://php.weblogs.com/adodbphp.weblogs.com/adodb//
- Package: PHPlot Package: PHPlot • Homepage: Homepage: http://http://www.phplot.comwww.phplot.com
- Package: JPGraph Package: JPGraph • Homepage: Homepage: http://http://www.aditus.nu/jpgraphwww.aditus.nu/jpgraph//
- Package: GD Package: GD • Homepage: Homepage: http://http://www.boutell.com/gdwww.boutell.com/gd//
Install ACID and snortInstall ACID and snort
Download ACIDDownload ACID- http://www.andrew.cmu.edu/user/rdanyliw/http://www.andrew.cmu.edu/user/rdanyliw/
snort/snortacid.htmlsnort/snortacid.html Decompress acid-0.9.6b23.tar.gzDecompress acid-0.9.6b23.tar.gz
Move ACID to your web directoryMove ACID to your web directory
Setting up the database in MySQLSetting up the database in MySQL
Create databaseCreate database
Create user and assign privilegeCreate user and assign privilege
Create snort tablesCreate snort tables
Modify ACID config filesModify ACID config files
Edit acid_conf.phpEdit acid_conf.php
Connect to sensor managerConnect to sensor manager
Open Open http://192.168.1.101/acid/acid_conf.phphttp://192.168.1.101/acid/acid_conf.php
Setup snort output moduleSetup snort output module
Edit /etc/snort/snort.confEdit /etc/snort/snort.conf
Test environmentTest environment
Internet
Name: ACID serverOS:LinuxIP:192.168.1.101Net Mask:255.255.255.0Gateway:192.168.1.2
Web Server: Apache 2.051SQL Server: MySQL 4.0.20Sensor: Snort 2.1.3Management: ACID 0.9.6 beta 23
Name: attacker1OS:WindowsIP:192.168.1.1Net Mask:255.255.255.0
Vulnerability Scanner: N-Sealth 5.2
三暝三日…
Enjoy the resultsEnjoy the results
Open http://192.168.1.101/acid/Open http://192.168.1.101/acid/
More analysisMore analysis
5 most frequent alerts (alert listing)5 most frequent alerts (alert listing) 15 most frequent alerts (unique source)15 most frequent alerts (unique source) Time profile of alertsTime profile of alerts Last 24 hoursLast 24 hours Last 72 hoursLast 72 hours
Performance Benchmarking of Performance Benchmarking of ACID (Page loading time) ACID (Page loading time)
Host:Host: Intel Mobile 800Mhz, 256 MB RAM Intel Mobile 800Mhz, 256 MB RAM OS:OS: Linux 2.2.16-22 Linux 2.2.16-22 Apache:Apache: 1.3.19 1.3.19 PHP:PHP: 4.0.5 4.0.5 MySQL:MySQL: 3.23.32 3.23.32 PostgreSQL:PostgreSQL:7.1.27.1.2 DB schema:DB schema: v102 v102 ACID:ACID: 0.9.6b10 - 0.9.6b13 0.9.6b10 - 0.9.6b13
I. Unique Alert Listing I. Unique Alert Listing (acid_stat_alerts.php) (acid_stat_alerts.php)
II. ACID Main page (acid_main.pII. ACID Main page (acid_main.php) hp)
SummarySummary
ReferenceReference
Performance Benchmarking of ACIDPerformance Benchmarking of ACID- http://www.andrew.cmu.edu/user/rdanyliw/http://www.andrew.cmu.edu/user/rdanyliw/
snort/perf/acid_perf.htmlsnort/perf/acid_perf.html NIST Intrusion Detection SystemNIST Intrusion Detection System
Appendix AAppendix A
Passive Ethernet Tap Passive Ethernet Tap
Internet
IDS
Traffic in
Traffic out
IDS
http://www.snort.org/docs/tap/