1 “ intrusion detection..provides the best chance for peace in an otherwise turbulent on-line...
Post on 24-Dec-2015
213 Views
Preview:
TRANSCRIPT
1
“ Intrusion detection ..provides the best chance for
peace in an otherwise turbulent on-line world.”
-- Paul E. Proctor in his book “The practical Intrusion Detection Handbook”,
2001, pp.xvii
2
tcpdump Analysis1. See the Server port numbers to find
the process that is running. If the process is not supposed to be running
=> Someone has maliciously installed some application without the knowledge of the system administrator.
Use of telnet (port number 23) may mean that the intruder wants to get hold of password fields, trusted host lists etc..
Example:15:35:23:830000 eth0 > srchost.51200> dsthost.www:S 252 392 488: 252 392 488 (0) win 2048 <mss 1024,nop,nop,timestamp 1562755,0> (DF) (ttl 64, id 5328)
3
tcpdump Analysis ….. continued2. Number of exchanges and the number of bytes
exchanged give an idea of the damage caused by the intruder.
(Did the intruder bring a moving van or a motor-cycle to carry away the booty?)
3. Who initiated and who ended the conversation?4. Repeated SYN attempts without a successful
connection.(The intruder is pushing at various doors to make
an entry.)Note: Flags (13th byte of the header): CWR, ECE, URG, ACK,
PSH, RST, SYN, FIN
4
tcpdump Analysis ….. Continued 25. ACK scan
Continuous tcp segments with no data and with only acknowledgement with destinations as hosts in a network
can discover live hosts in the network. A live host will respond with a RESET,
since no connection has been established. A filter, which allows messages between
established socket connections only to go through, by identifying messages with ACK flag set, will fail to filter such messages.
5
tcpdump Analysis Telnet Scan
6. Telnet Scan (port 23) A train of SYN messages with ‘X’ bytes of data
to one (or more) network(s) => To find all the destination hosts that offer telnet service.
What’s more, this X bytes of data will be stored in the buffer and it will be delivered to the application after the handshake has been completed.
This may be a good way to avoid detection by an Intrusion Detection System (IDS) since IDSs usually examine data only after the connection is established.
6
tcpdump Analysis Telnet Scan….. continued 4
Note: The same type of scan can be used for other ports to find those destination hosts which provide certain type of service.
However, there is a NORMAL activity for DNS port (port no. 53) and it should not be misconstrued as an INTRUSION.
A software package called 3DNS is designed to attempt to give a user the quickest response time to Web request. For this purpose, 3DNS measures the response time from one or more Web servers to the user’s DNS Server, using typically a 64 bytes data.
7
tcpdump Analysis ……… Packet Flooding7.Packet Flooding
Disable domain name lookups ( -n option). Locate the source of a large number of
packets.
Example: (Reference: James Kretchmar,” Open Source Network Administration”, Prentice Hall 2004)
Linux# tcpdump -n 17:36:16.265220 10.255.255.27.1221 > 10.18.0.100.9995: udp
1168 (DF) 17:36:16.269171 10.255.255.27.1221 > 10.18.0.100.9995: udp
1168 (DF)
8
tcpdump Analysis ……… continued 617:36:16.273130 10.255.255.23.1221 > 10.18.0.100.9995:
udp 1168 (DF) 17:36:16.285228 10.255.255.27.1221 > 10.18.0.100.9995:
udp 1168 (DF) 17:36:16.302173 10.255.255.27.1221 > 10.18.0.100.9995:
udp 1168 (DF) 17:36:16.319372 10.255.255.27.1221 > 10.18.0.100.9995:
udp 1168 (DF) 17:36:16.334600 10.7.15.65.7000 > 10.18.1.140.7001: rx
ack (66) (DF) 17:36:16.334975 10.7.15.65.7000 > 10.18.1.140.7001: rx
data (36) (DF) 17:36:16.336606 10.255.255.27.1221 > 10.18.0.100.9995:
udp 1168 (DF) ...........
9
tcpdump Analysis ……… continued 7 Conclusion:
Large traffic from 10.255.255.27 port 1221, directed at 10.18.0.100.
Each packet: a UDP datagram with 1168 bytes of UDP payload data.
The small difference in time stamps between packets the high speed with which they are being sent.
10
tcpdump Analysis ……… continued 88. Reported Problem: Several hosts on a
net start having trouble accessing a Web server. The Web browser just hangs.
Network manager: has been able to connect to the web server from his workstation.
Tests of connectivity show that the connection is there.
To solve: Use a machine running tcpdump
11
tcpdump Analysis ……… continued 9 First Test:
Look at the Web traffic originating from a workstation exhibiting the problem.
Start tcpdump. Configure it to monitor port 80 (the port used for HTTP transactions).
Try to open the page in a Web browser: # tcpdump host client.example.com and port 80 Reading: No traffic. Conclusion: The problem is not at the Web
server. If no traffic is sent to the Web server, there cannot be a response.
12
tcpdump Analysis ……… continued 10
Second Test: to look at more traffic, remove the port 80 restriction:
# tcpdump -xs 1500 host client Result:
18:14:12.842409 brokenclient.example.com.55313 > dns.example.co... 4500 0048 058b 4000 ff11 9d80 0a12 0064 E..H..@........d 0a05 061e d811 0035 0034 8a44 e4ca 0010 .......5.4.D.... 0001 0000 0000 0001 0377 7777 0765 7861 .........www.exa 6d70 6c65 0363 6f6d 0000 0f00 0100 0029 mple.com.......) 0800 0000 8000 0000 ........
13
tcpdump Analysis ……… continued 11
Analysis: A message is sent to DNS server. But it is not responding.
Those hosts, who had the address of the web server, before the DNS server went down, are able to connect to the web server.
Solution: Make the DNS server work.
14
“There is no security on this earth, there is only opportunity.”
- General Douglas MacArthur
TOOLS
15
16
TCP Session Hijacking Sniffers snoop clear-text data such as User ID,
passwords. Similarly, sniffers can find out
IP numbers and port numbers of a connection Sequence Numbers and the aggregate number of
bytes already exchanged Acknowledgement Numbers
And hijack the session, at one end, from the authorized user to an evil host.
Two software packages do this job:- Hunt- Juggernant
17
Intrusion Detection Tool: nmap Network Mapper
Open source utility for network exploration or for security auditing.
Designed for rapid scan of large networks (can be used for single hosts also).
Used To determine what hosts are available on the
network. To find what services(ports) the hosts are offering. To find the OS and its version on a host. To find the type of packet filter/firewall in use.
18
Scanning methods by nmap
1. TCP Connect() scanning: The system call connect() used to open a connection to every interesting port on the target m/c. If the port is listening, the connection succeeds.
Otherwise PORT UNREACHABLE message. Advantage: the fastest scanning method. Option: nmap –t Disadvantage: the scan is easily detectable and
filterable.
19
Scanning methods by nmap (continued)
2. TCP SYN (Half-Open) scanning: Send a SYN segment as if to open a connection. A response of SYN/ACK means the port is
listening. RST indicates a non-listener port. Advantage: Less number of sites log it. Disadvantage: Need root privileges to build
the custom SYN segments. Programs like synlogger, Courtney, tcplog and
netstat detect such scannings. Option: nmap -s
20
Scanning methods by nmap Stealth
Scanning 3. Stealth scanning or TCP FIN scanning:
Send segment with FIN and ACK flags on. Open ports ignore the packet. But closed ports send RST. (Windows responds with RST in both the
cases.) Option: nmap –u Disadvantages:
Root privilege required to build the custom-built package.
Not reliable since different OS and architectures respond in different ways.
Windows may respond with a RST in both the cases.
21
Scanning methods by nmap Stealth Scanning
(continued) Advantages:
Difficult to log; Does not show up on netstat. Can circumvent firewalls.
Another Variant of stealth scanning: Send only an ACK segment.
If the port is listening, the TTL of the returning RST packet may be
lower or the window advertisement may be non-zero.
If the port is not listening, again a RST is received. But TTL would not be lower or the window advertisement may be zero.
22
Scanning methods by nmap Stealth Scanning
(continued) Disadvantage: TTL bug is only on
Linux. Non-zero window bug is
on all BSD-based systems. But if these bugs are removed, the
method may not work.
23
IP Fragmentation Some IDS and packet-filtering devices do
not support packet reassembly. So if the hacker’s program is divided into
multiple packets, using fragmentation, such IDS or packet filtering devices may not be able to help.
nmap can send a fragmented tcp segment to perform a stealth-scan to discover the ports that are open on a desthost. The fragmented packets may elude detection by IDS.
24
Scanning methods by nmap (continued)
4. Fragmentation scanning: Split the TCP header into tiny segments so that packet-filters will not be able to detect the scan, unless they are willing to pay the penalty of queuing all the fragments. Option: The option -f instructs the
specified SYN or FIN scan to use tiny fragmented packets.
25
Nmap (continued) Example: At srchost, the following command is
given:nmap –f –s –p53 dsthost
This sends a series of fragmented SYN messages to port 53 (DNS port) of dsthost.
tcpdump output will be:srchost>dsthost: truncated-tcp 16 (frag 108: 16@0+)srchost>dsthost: (frag 108: 4@16) srchost>dsthost: truncated-tcp 16 (frag 102: 16@0+)srchost>dsthost: (frag 102: 4@16)srchost>dsthost: truncated-tcp 16: (frag 528: 16@0+)srchost>dsthost: (frag 528: 4@16)
26
Scanning methods by nmap
(continued) 5. Reverse identification Scanning:
Once a valid TCP connection is established between A and B, either end can use Identification Protocol (RFC 1413)
to find out about all the active ports and their owners, relating to connections between hosts A and B only.
The response is: <port on client> ,<port on Server>: <response
type>: <address info.>
27
Scanning methods by nmap
(continued) Response type: Example: the response may be of one of the
following two types: Type1:
6193, 23: Userid: Unix: stjohns Type2:
6195, 23: Error: No-User Type1:
OS names can be one of those permitted in RFC 1340 (or ‘others’ will appear in place of OS name.)
The owner is the userid of the owner of the port-process. This may be the e-mail address of the owner.
28
Scanning methods by nmap
(continued) Type2: Can be of the following types:
Invalid port No-user: the port is not currently in use Hidden-user Unknown error (could be even one of the 2nd or 3rd, if
the server is configured not to specify the 2nd or 3rd type of error.)
Reverse identification scanning is used to find whether the server is running as a root.
Option: with –t option (full TCP connection), -i option connects to the http port of the
server and queries for the owners of all the listening ports by using Identification Protocol.
29
Scanning methods by nmap
(continued) 6. FTP bounce attack:
If host A establishes a FTP connection with an FTP server B, A can ask B to initiate a connection with C, with B providing an active FTP port.
Using PORT command, B can scan the ports of C to find which ports are active. With active ports, the transfer of data will be successful (generating a 150 and a 226 response).
With passive ports, the response 425 will say “The connection refused, cannot build data connection.”
Option: -b with nmap.port server specified as username:password@server, port, with everything but server being optional.
30
Scanning methods by nmap
(continued) 7. UDP ICMP port unreachable scanning:
UDP: open ports: do not send ACK closed ports don’t send RST. However an
ICMP Port Unreachable message is sent by most of the hosts, if a message is sent to a closed UDP port.
However neither UDP datagrams nor ICMP packets are guaranteed to reach their destination. So repeated transmissions are required.
RFC 1812 Sec 1.3.2.8 recommended that ICMP error message rate be limited. Linux, for example, limits Destination Unreachable messages to 80 per 4 seconds. So nmap repeat messages are used at a slow rate.
31
Scanning methods by nmap
(continued) Disadvantage: Need root access to reach raw ICMP
socket for reading the port unreachable message. Option: nmap –u For Non-root users: a lamer UDP scan: Linux
informs a user indirectly about the receipt of port unreachable message. It does this as follows:
A second call to a closed port fails. recvfrom() on a non-blocking UDP socket returns:
EAGAIN (Try Again) if the ICMP error message has not been received;
ECONN REFUSED (Connection refused) if the port unreachable message has been received.
Option: After the use of –u option, a non-root user may use –i to get the information.
32
Scanning methods by nmap
(continued) 8. ICMP Echo Scanning:
Not port scanning Determines which hosts in a network are up
by pinging them all. Parallel pinging --> fast Option: nmap –P To speed up the scanning further, the number
of pings in parallel can be increased by using –L option.
To adjust ping timeout, -T option can be used. Supports CIDR notation:
33
Scanning methods by nmap
(continued) Example: nmap –P cert.org/24 152.148.0.0/16 will scan class C network of cert.org and the class B
network starting with 152.148. 0.0. The address can be written as:150.12,17,71-79.7.*
The entry 12,17,71-79 means the second term of the dotted decimal notation address can acquire any one of the following values: 12,17,any value from 71 to 79.
The entry * means any value from 0—255 (leaving out the network or broadcast addresses).
The option –A can allow broadcasting of pings.
34
Scanning methods by nmap
(continued) General
1. Parallel port scanning in both TCP and UDP modes is used. The number of parallel scans can be adjusted by –M option.
2.A) Selective port scanning:Example: nmap –p 21-25, 80, 113, 60000- means that
the following ports will be scanned: 21 to 25, 80, 113, 60000 to 65535.
2.B) Selective port scanning:-F option scans all the ports in your /etc/services file.
3. nmap find out the IP address of your machine and uses it. If you want to give it, use –S option.
35
Scanning methods by nmap
(continued) General
1. Parallel port scanning in both TCP and UDP modes is used. The number of parallel scans can be adjusted by –M option.
2.A) Selective port scanning:Example: nmap –p 21-25, 80, 113, 60000- means that
the following ports will be scanned: 21 to 25, 80, 113, 60000 to 65535.
2.B) Selective port scanning:-F option scans all the ports in your /etc/services file.
3. nmap find out the IP address of your machine and uses it. If you want to give the address yourself, use –S option.
36
Scanning methods by nmap
(continued) 4. –v option: verbose 5. –r option: randomizes the target
hosts port numbers for scanning 6. –h option: for a summary of all
options 7. –R option: resolve all hosts,
even down ones.
37
Despoof
Despoof: freeware open-source Unix utility (based on an idea by Donald Malachlan)
It tries to determine whether the packet is spoofed by looking at TTL values.
38
Other top scanners available today1. strobe by Julian Assange, 2. netcat by *Hobbit*, 3. stcp by Uriel Maimon, 4. pscan by Pluvius, 5. ident-scan by Dave Goldsmith, and the 6. SATAN tcp/udp scanners by Wietse Venema7. Dragon IDS8. RealSecure9. Network Flight Recorder10. Firewalls and Access Control Lists 11. Nessus from Nessus Corporation12. CyberCop Scanner from Network Associates13. Secure Scanner from CISCO14. Internet Scanner from Internet Security Systems
39
References 1. tcpdump: (developed by Network Research Group at
the Lawrence Berkeley Laboratory)
ftp://ftp.ee.lbl.gov/tcpdump.tar.ztcpdump source and binaries:
http://www.tcpdump.org (as of Nov. 09, 09) 2. libcap (developed by Network Research Group at the
Lawrence Berkeley Laboratory):
a software, which implements a portable framework for capturing low level trafficftp://ftp.ee.gov/libcap.tar.z
3. windumphttp://netgrooup.serve.polito.it/windump
40
References (continued) 4. tcpshow
http://the.wiretapped.net/security/port-loggers/tcpshow.c 5. nmap
www.insecure.org/nmap (as of Nov. 09, 2009) 6. netcat: available for both unix and windows platformhttp://www.atstake.com/research/tools/network_utilities/ (as
of Nov. 09, 2009) 7.Netstat BSD Manual:
http://www.tac.eu.org/cgi-bin/man-cgi?netstat+1 (as of Nov. 09, 2009)
http://snowhite.cis.uoguelph.ca/course_info/27420/netstat.html
41
SHADOWSHADOW
An open source network monitoring system, based on tcpdump.
•It monitors all ports.•Logs large amount of data, by using a limited number of cpu cycles
Reference:http://www.nswc.navy.mil/ISSEC/CID
42
A shadow system
To set up a shadow system: 2 Unix workstations, PC Pentiums
running Linux or Free BSD are preferred
At least 9 Gigabyte disk per system
SHADOW software (FREE)
43
Overview of the Architecture
FW
Analysis/Display Station
Collect Data
Analyze DataDisplay Information
“…countries such as Russia, the United States and China are developing advanced offensive capabilities. “
“The idea of a global cyber-arms race has become a reality. …Today, the weapons are not nuclear, but virtual”
---Dave DeWaltPresident and CEO, McAfee, Inc.
in fifth annual Virtual Criminology Report, 17th November 2009http://img.en25.com/Web/McAfee/VCR_2009_EN_VIRTUAL_CRIMINOLOGY_RPT_NOREG.pdf
44
Multiple IDSs and Multiple Sensors
45
Why Multiple ID Systems
No ID system is capable of detecting all existing attacks Some are better at detecting certain types
of attacks Example: RF Protect does not detect a Xmas
tree scan where as Snort would detect an Xmas tree scan;
If we use both ID systems, then the attacks covered by both of them can be detected
An ID system, deployed to monitor traffic in the network, can decide about intrusions only on the basis of data, which it can capture. Example: IDS sensors, if not deployed carefully, may
miss the data at the periphery of a wireless network.
46
Multiple Sensors for IDSs In Ad Hoc networks, intrusion may be detected by
using the observations of a distributed set of nodes. In such networks: Each node can observe only a part of the traffic. The degree of trustworthiness of an observer
node may be determined by noting its external behavior by the neighboring nodes.
For intrusion into a Wireless Network: Hackers may use powerful antennas, which
could detect wireless networks from a very far distance: Easily available.
47
Multiple Sensors
1. Snort sensor using the Snort IDS
2. Ethereal sensor3. RealSecure by ISS acquired by IBM.
http://www-935.ibm.com/services/us/index.wss/offerfamily/iss/a1029097
Whether a network sensor is available from IBM is not very clear
Hardware sensors48
Snort Sensor & Ethereal Sensor Snort Sensor - Snort is a free open source
intrusion detection system capable of performing real time traffic analysis on IP networks: use one computer that’s configured to run snort which monitors a wireless network in promiscuous mode.
Ethereal Sensor - Ethereal is a powerful network protocol analyzer used by industry professionals to troubleshoot and analyze network problems: use one computer that’s configured to run Ethereal which monitors a wireless network in promiscuous mode.
49
Hardware Sensors OrcaFlow®-EE sensors: for Ethernet (probably not for
wireless) http://www.orcaflow.ca/orcaflow-ca/products/sensors AirDefense Solutions which has sensors and IDs in the
same product: rated highly in the markethttp://www.airdefense.net/http://www.airdefense.net/products/index.phphttp://www.scmagazineus.com/AirDefense-Enterprise-
v73/Review/1165/ AP70
50
Aruba AP-70 Sensors Aruba AP-70 sensors are proprietary sensors from Aruba
networks. They connect to a server that runs the RF protect intrusion
detection system. AP-70 sensors are specialized for wireless monitoring (RF
monitoring). They have a wide range compared with the other sensors that
are used in the research.
51
Aruba AP-70 ….2 an Access Point: “indoor wireless access point capable of
supporting a wide range of functions including WLAN access, air monitoring/wireless intrusion detection and prevention, and secure enterprise mesh across the 2.4-2.5 GHz and 5 GHz RF spectrums.” – from Aruba web-site
works with RF Protect by Network Chemistry http://www.networkchemistry.com/products/system.phpRF Protect consists of the following modules.
RFprotect Sensors - Monitor the air waves over a physical environment
RFprotect Server Engine - Performs centralized detection analysis RFprotect Client Console - Provides GUI for the system RFprotect Third Party Integration SDK - Facilitates easy integration
with third party security and network operations systems
52
Sensing ID through multiple sensors
Distributed Sensors/ IDSs & a Central Server: Each sensor may be able to inform a central
server about the data, that it is able to see. Each IDS may inform the central server about
the alerts, it is able to generate, using its own algorithm.
NEED: to combine the information from sensors and IDSs in a distributed network to optimize the information about intrusions ( to reduce the number of false positives and false negatives)
53
Dempster-Shafer Theory (D-S theory) Theory of Evidence - The Theory of Evidence is a
branch of mathematics that is concerned with using evidence to calculate the probability of an event.
Dempster-Shafer Theory (D-S theory) – a theory of evidence used to fuse together
multiple pieces of evidence from multiple observers, who differ in their
trustworthiness. to estimate the likelihood of an intrusion.
54
Definitions
55
The Frame of Discernment orUniverse of Discourse (Θ)
A complete (exhaustive) set describing all of the sets in the hypothesis space.
Generally, the frame is denoted as Θ. The elements in the frame must be
mutually exclusive. Power Set: The set of all subsets of a given
set is called the Power Set: called P(Θ ). If the number of the elements in the set is
n, then the power set (set of all subsets of (Θ) will have 2n elements. (Empty set is a member of all sets.)
56
BPA (Basic Probability Assignment) The D-S theory assigns a belief mass to
each subset of the power set. It is a positive number between 0 and 1.
It exists in the form of a probability value.
If Θ is the frame of discernment, then a function m: 2Θ [0, 1] is called a bpa, wheneverm (∅) = 0, andm(A) ≥ 0, ∀A ⊆ ΘΣ m (A) = 1, A ⊆ Θ
Notes: 1. f:XY means the function f maps the set X into the set Y.
2. ∅: the null set
57
Example 1 To determine whether a node S is trustworthy or
not: Observations from three nodes: 1, 2 and 3 about
the node S U = {S, S’, ∅} Given data:
What is the estimate about S? (Please see the solution after a few slides.)
58
k = 1 k = 2 k = 3
mk(S) 0.9 0.2 0.8
mk(S’) 0 0 0
mk(U) 0.1 0.8 0.2
Dempster’s Combination Rule: for a fusion of two observations, with less than 100% reliability
The combination called the joint mass (m12) is calculated from the two sets of masses m1 and m2.
Σ m1(B) m2(C) for all B ⋂ C = A
m12 (A) = ----------------------------------------------- 1 - [Σ m1(B) m2(C) for all B ⋂ C = ∅ ]
m12 (A) = Combined belief in the hypothesis A
m1(B) = Belief committed to B as seen by the first observer
m2(C) = Belief committed to C as seen by the second observer
59
An example: Dempster’s Combination Rule Case of a Universe having two possible hypotheses
Assume: DoS attack is being monitored by two IDSs.Let X: hypothesis that the DoS attack has been detected. X’: hypothesis that the DoS attack has not been detected.Universe: U ={ X, X', Nullset}From the characteristics of observer 1 and 2 Determine the
values of belief masses for m1(X), m1(X'), m1(U) and for m2(X), m2(X') and m2(U).
Combination of two observations: m12 (A) = Numerator/Denominator,
-- where A is any member of the universe Denominator: common for all the three possible values of A:
Denominator = 1 - (m1(X). m2(X') + m1(X'). m2(X))
60
An example: Dempster’s Combination Rule
Case of a Universe having two possible hypotheses…2 Numerator of the fusion for A: sum of all the
(components of the "product of a member from observer 1" and "a member from observer 2" such that the two members have an intersection equal to A, where A is any member of the universe.
Finally, m12(X) = (m1(X). m2(X) + m1(X). m2(U) + m2(X). m1(U))/D
m12(X') = (m1(X'). m2(X') + m1(X'). m2(U) + m2(X'). m1(U))/D
m12(U) = (m1(U).m2(U) )/D
61
Example 1 …………2m12(X) = (m1(X). m2(X) + m1(X). m2(U) + m2(X).
m1(U))/D
whereD = 1 - (m1(X). m2(X') + m1(X'). m2(X))
= 1-0 = 1m12(X) = 0.72 + 0.18 + 0.08 = 0.98
m12(X’) = 0
m12(U) = 0.02
m123(X) = 0.196 + 0.784 + 0.004 = 0.984
62
Belief (b) Given a frame of discernment Θ
and a body of empirical evidence {m(B1), m(B2), m(B3)….}, the belief committed to A ε Θ is
b(A) = Bel (A) = Σ m(Bi) Bi ⊆ AAlso, Bel (Θ) = 1
63
Disbelief (d) Given a frame of discernment Θ and
a body of empirical evidence {m(B1), m(B2), m(B3)….}, the disbelief committed to A ε Θ is
d(A) = Disbel (A) = Σ m(Bi) for all Bi ⋂ A = ∅The disbelief in x is equal to the belief in
x’.
64
Plausibility/ Uncertainty Function (Pl)
The plausibility (Pl) is the sum of all the masses of the sets B that intersect the set of interest A: u(A)= Pl (A) = Σ m (Bi) ,
Bi | Bi ⋂ A ≠ ∅ and Bi is not a subset of B and is not equal to
B.
65
Belief Range The interval [ Bel (A), Pl(A) ] is
called the belief range. Plausibility (Pl) and Belief (Bel) are
related as follows [2]
Pl (A) = 1 – Bel (Ᾱ)
66
Atomicity
67
Relative Atomicity of x to y is defined as:
Notes:If y be the universe, it is called a(x).If intersection of x and y be null, a(x/y) = 0.If y be a subset of x or be equal to x, a(x/y) = 1
ω = (b, d, u, a) is the tuple, which characterizes a set.
Consensus operatorReference: Audun Josang,”The Consensus Operator for Combining Beliefs”http://www.sciencedirect.com/science?_ob=MImg&_imagekey=B6TYF-46RDC1K-3-1&_cdi=5617&_user=1010624&_orig=search&_coverDate=10%2F31%2F2002&_sk=998589998&view=c&wchp=dGLzVtz-zSkzV&md5=7ddddf3c04a1f2a3ff0cd34ee5a020f6&ie=/sdarticle.pdf as of Nov 12, 2009
68
Dogmatic Belief k = u1(x) + u2(x) - u1(x). u2(x) If k = 0, the opinions are dogmatic. Relative dogmatism = RD = u1(x)/ u2(x) If u1(x), u2(x) 0, we have to determine the way in
which the two go towards 0. In case, uncertainty is negligible and dogmatism is high,
consensus may be used.
69
Examples from Josang’s paperReference: Audun Josang,”The Consensus Operator for
Combining Beliefs” http://www.sciencedirect.com/science?
_ob=MImg&_imagekey=B6TYF-46RDC1K-3-1&_cdi=5617&_user=1010624&_orig=search&_coverDate=10%2F31%2F2002&_sk=998589998&view=c&wchp=dGLzVtz-zSkzV&md5=7ddddf3c04a1f2a3ff0cd34ee5a020f6&ie=/sdarticle.pdf page 11 as of Nov 12, 2009
Zadeh’s example with modification: A murder case with three suspects – Peter, Paul and Mary; Two witnesses give highly conflicting testimony.
The table shows the results obtained by using Dempster-Schafer Theory and Consensus operator: (In the following table, if 0.98 be changed to 0.99, and if 0.01 be changed to 0.00, Dempster’s Rule will give totally wrong results.)
0.00
70
W1 W2 Dempster Rule
ConsensusOperator
Peter 0.98 0.00 0.490 0.492
Paul 0.01 0.01 0.015 0.010
Mary 0.00 0.98 0.490 0.492
Θ 0.01 0.01 0.005 0.005
∅ 0.00 0.00 0.000 0.000
71
Another utility for creating Log Files: Netstat
Netstat was distributed free along with BSD 4.2.
Microsoft has also provided it in Windows.
“Netstat is a program that accesses network
related data structures within the kernel, then provides an ASCII format at the terminal.”
RFC on Internet Tool Catalog
72
Netstat The Netstat utility provides statistics on
the following network components: Foreign Socket Address
The IP address and port number of the remote computer to which the socket is connected.
The name corresponding to the IP address is shown instead of the number, if the Hostsfile contains an entry for the IP address.
In cases where the port is not yet established, the port number is shown as an asterisk (*).
73
Netstat (continued)
Local Socket Address The IP address of the local computer, and the port
number the connection is using. The name corresponding to the IP address is
shown instead of the number, if the Hostsfile contains an entry for the IP address.
In cases where the port is not yet established, the port number is shown as an asterisk (*).
Proto The name of the protocol used by the connection.
(state) Indicates the state of TCP connections only.
74
Netstat (continued) Syntax:
netstat [-a][-e][-n][-s][-p protocol ][-r][interval] Parameters:-a: Displays all connections and listening ports.
Used to display all open connections on the local machine.
For the remote host, it returns the remote system to which we are connected, the port numbers of the remote system we are connected to (and the local machine) and
the type and state of connection we have with the remote system.
75
Netstat (continued)Server connections are normally not shown.Example:C:\windows>netstat -a Active ConnectionsProto Local Address Foreign Address StateTCP ankit:1031 dwarf.box.sk:ftp ESTABLISHEDTCP ankit:1036 dwarf.box.sk:ftp-data TIME_WAITTCP ankit:1045 mail2.mtnl.net.in:pop3 TIME_WAIT
*Above example from Ankit Fadia’s book
76
Netstat: Exampledavinci% netstat -aShows the state of all sockets and all routing table entries.( 3
UDP and 3 TCP connections are shown in slides 46, 47 and 48.
UDP Local Address Remote Address State
*.* Unbound The local host address or network address and the port
number are unspecified. This host is not ready to either connect or listen.
*.sunrpc Idle The local host address or network address is unspecified. This
host is opened, but not ready to either connect or listen.
77
Netstat: Example (continued)davqfe0.33015 137.207.216.140.35022 Connected The local host name is davqfe0 and the port number is 33015.
The remote host address is 137.207.216.140 and the port number is 35022. These two hosts have been connected.
TCPLocal Address Remote Address Swind Send-Q Rwind Recv-Q State
davinci.newcs.uwindsor.ca.32833 davinci.newcs.uwindsor.ca.32802 32768 0 32768 0 ESTABLISHEDThe connection between local host and remote host has beenestablished. The send and receive windows are both 32768, and the
send and receive Qs are both 0.
78
Netstat: Example (continued)davinci.newcs.uwindsor.ca.40602 server.ftp 49152 0 8760 0 CLOSE_WAIT The internal state of the protocol is waiting for the
socket to close.
localhost.utauthd-cb localhost.42300 32768 0 32768 0 TIME_WAIT The internal state of the protocol is waiting for remote
shutdown retransmission after close.
79
Netstat (continued)
-e: Displays Ethernet statistics. This may be
combined with the –s option.
-n: Displays addresses and port numbers in
numerical form (rather than attempting name
look-ups).
-s: Displays per-protocol statistics. By default,
statistics are shown for TCP, UDP, ICMP, and
IP. The –p option can be used to specify a
subset of the default.
80
Netstat (continued)Example:davinci% netstat -s Shows per-protocol statistics.
UDP udpInDatagrams = 14107916 udpInErrors = 0 udpOutDatagrams =31858498
TCP (Only some examples of data are shown. In practice, the
TCP data is extensive.)tcpActiveOpens = 78986 tcpPassiveOpens = 51785tcpAttemptFails = 261 tcpEstabResets = 2563 Similarly data for IP and ICMP are shown.
81
Netstat (continued) -p protocol: Shows connections for the protocol
specified by protocol; protocol can be tcp or udp. If used with the –s option to display per-protocol statistics, protocol can be tcp, udp, icmp, or ip.
Example:davinci% netstat -p tcp Limit display of statistics or state of all sockets to TCP
protocol.
TCP Local Address Remote Address Swind Send-Q Rwind Recv-Q State
82
Netstat (continued) davinci.newcs.uwindsor.ca.139davinci.newcs.uwindsor.ca.33073 32768 0 32768 0 ESTABLISHEDdavinci.newcs.uwindsor.ca.32830davinci.newcs.uwindsor.ca.32799 32768 0 32768 0 ESTABLISHED
-r: Displays the contents of the routing table.interval: redisplays selected statistics, pausing
intervalseconds between each display. Press CTRL+B to stop redisplaying statistics. If this parameter is omitted, netstat prints the currentconfiguration information once.
83
Netstat (continued)‘Netstat’: normally used, to get a list of
open ports on your own system. This can be particularly useful to check
and see whether your system has a Trojan installed or not.
A sample list of Trojans and their ports: Port 12345(TCP) NetbusPort 31337(UDP) Back OrificeUse a Trojan Remover, if required.• Reference for a complete list of Trojans: http://hackingtruths.box.sk/trojans.txt
top related