IPS第三天-Work Blog

CISCO CCSP IPS6.2 作者：现任明教教北京 WOLF 安全实验室出品第一天：安全与 | PS 基本理论， Conso | e 初始化《 PS 第二天：旧 M 配置沪 S ， Signatures 与 Alerts 第四天：调整 IPS 参数，配置 Blocking 第五天：维护与监控《 PS ，初始伽 ps 模块 ccsp IPS 6.2 : Signature Enginefr%, EYSignatures • Signature Engine"" Common • Signaturesæ ccsp IPS6.2 EnginefrÆ Engine Overview —'Signature EngineÆSensor • Cisco IPS Signature • IPSMJSignature Signature EngineÆV T 0 ccsp IPS6.2 EnginefrÆ Engine/y}h 1 • ATOMIC • FLOOD • SERVICE • STRING • SWEEP Engine-fm ccsp IPS6.2 Engine5}3€ 2 • TROJAN • TRAFFIC • AIC • STATE • META • NORMALIZER CCSP IPS6.2 现任明教教主出品第一部分 -Signature Engine 介绍 Engine Parameters 一个引擎参数由一个名字和一个值蕴成。 1 2 ．参数的名字是为这些引擎定义的 3 ．参数值在一个特定引擎里边被定义了一个限制值。 4 ．参数的名字在一个特定引．擎的所有 sig 里边是恒定不变的，但是这个参数的值在不同的 sig 里边是变化的。 5 ．有些参数是普遍出现在所有引擎里边的，但是另一些就只会在特定的引擎里出现 ccsp IPS6.2 EnginefrÆ Atomic Engine These are support signatures that aretriggered by the content of a single packet. They do not store any state information across ackets. • ATOMIC ARP • ATOMIC IP ATOMIC IP Advanced ATOMIC IP version 6 ccsp IPS6.2 EnginefrÆ Atomic OS List ccsp IPS6.2 EnginefrÆ FLOOD Engine The FLOOD signature engines are designed to detect attacks in which the attackerfloods traffic to a single host or an entire network. PC • FLOOD.NE • FLOOD.HOST Engine5t!B FLOOD S.ttin« r: ıcn ccsp ıpş6.2 -2.1 ccsp IPS6.2 EnginefrÆ SERVICE Engine 1 These engines analyze traffic at and above Layer 5 of the OSI model. They provide protocol decoding for numerous protocols. SERVICE DNS SERVICE FTP SERVICE GENERI& SERVICE GENERIC ADVANCED SERVICE H225 SERVICE HTTP SERVICE IDENT SERVICE MSRPC $CCSP IPS6.2 现任明教教主出品第一部分 -Signature Engine 介绍正则表达式：必须以特定字符开始。例如： AA 2 ．在 “ [ " 右边使用 “ ^ " ：表示排除 [ ] 部的字符。例如： [ ^ 0 · 9 ] “ $ ” ：表示必须以 $ 左边的字符结尾」如 abc$ 3 ．：或者。例如 Rootlroot 4 ．：匹配任何一个字符 0 例如． a ． b 5 ，：表示．左边的孛符出现零次或者多次。例如． a ' 6 ． ' + ，：表示 * 表边的字符出现至少一次。例如： a + 7 ．？左边的字符出现零次或一次。例如 a? 8 ． [ ] 内部的所有字符任选其一。例如 :[Rr]oot 9 ． 10 ， “ \ ” ：转义符。例如： cmd\.exe$ ccsp IPS6.2 EnginefrÆ STRING Engine The STRING signature engines support regular expressions for pattern matching. Also, älarm functionality is provided for ICMP, UDP, and TCP%State information is maintained because pattern matches are made across a stream of packets. STRING ICMP STRING TCP STRING UDP Multi STRING ccsp IPS6.2 EnginefrÆ STRING Sr.ciiy s,.eify Sp.eify ccsp IPS6.2 EnginefrÆ SWEEP Engine The SWEEP signature engines detect attacks that involve the attacker making connections to multiple hosts and/or ports. SWEEP SWEEP other supports signatures that fire when a mix of TCP packets have different flags set. ) [lâms d33MS EVau!6ü3 ccsp IPS6.2 EnginefrÆ TROJAN Engine These engines are designed to detect Trojan program attacks against your network: TROJAN B02K (examines UDP and TCP traffic for Back Orifice.) TROJAN TFN2K (examines UDP, TCP, or ICMP traffic for irregular traffic patterns and corrupted headers TROJAN UDP examines UDP traffic for Trojan attacks. ) ccsp IPS6.2 EnginefrÆ TRAFFIC Engine The TRAFFIC signature engines analyze nonstandard protocols such as TFN2K, LOKI, and DDOS. TRAFFIC ICMP (examines protocols such as LOKI.) TRAFFIC Anomali examines UDP, TCP, and other traffic for 7 worms. ccsp IPS6.2 Enginefrgg AIC Engine The AIC engines provide Layer 4 to Låyer 7 inspection for HTTP and FTP. AIC FTP AIC HTTP To use these engines, you must enable Application Policy enforcement. To do this, choose Configuration > Signature Definitions > Sigo > Miscellaneous > Application Policy. EnginefrÆ Miscellaneous ccsp IPS6.2 Tab Cisco ccsp IPS6.2 EnginefrÆ Miscellaneous 2 Fra.ent Reassobly Reassembly Mode • Fragment Reassembly frit) — IP Reassembly the method the sensor uses to reassemble the fragments, based on the operating system. ccsp IPS6.2 EnginefrÆ STATE Engine This engine enables the sensor to inspect the various states of Cisco login, an LPR format string, or SMTP. (XiCiscoe%, ccsp IPS6.2 EnginefrÆ STATE Loon c Viet'. Off"' Sv«.fy ccsp IPS6.2 EnginefrÆ META Engine The META signature engine provideS event correlation. This engine takes signature events as its input instead of packets An example is many signatures firing within a certain time limit to indicate the Nimda attack. ccsp IPS6.2 EnginefrÆ The Meta Event Generator Meta Reset Interval = 3 ?econds Signature 5081 cmd.exe Access Signature 5124 IIS CGI Decode Signature 5114 IIS Unicode Attack NIMDA Signature 3215 Oot Dot Execute Signature 3216 Dot Oot Crash Signature 5081 +5124+5114+3215+3216=NlMDA. If the 5 signatures fire within a 3 second interval, the meta signature, NIMDA, fires. CCSP IPS6.2 现任明教教主出品第一部分 -Signature Engine 介绍 Meta 实例 C* 》 0 如《 n 《《只生 ir 以 EWi:Common Parametersfr% Common Parameters Definition —O Sig..ture ID Alert Severity Sig Fidelity Rating •Signature ID •SubSignature ID ccsp IPS6.2 0 arm •t i on•l •Alert Severity (Highl Medium I Low I Informational, ASR, .Sig Fidelity Rating (SigWAtJE, SFR, f91JU11:75k •Promiscuous Delta PC)' Rating ccsp IPS6.2 EMSfr:Common Parametersfr% Threshold Parameters and Automatic Alarm Summarization Summary Interval Summary Mode Summary Thres FireAll s Summarii? GIOFI Summary Threshold Global Global Summarize Automatic alert summarization enables a signature to change alert modes automatically based on the number of alerts detected within the Summary Interval parameter. Interval 18 Summary"jt ) CCSP IPS6.2 现任明教教主出品第三部分 Signatures 配置实例实验拓扑 172 ． 1 & 23 引 24 R № 二 0 ． 0 丶 24 寸 0 & 二 & 卜． 4 R XP 1 閬 R 1. ccsp IPS6.2 Raise the severity of signature 2004 to the highes€level sac 3 ccsp IPS6.2 3. All individual alarms from this signature should be report Frequency Sp•ei fy Key 4. Verify the operation of this signature ccsp IPS6.2 alert 112.16.23.3 S. to ln.16.23.3. ti—t is 2 is ISIS). • .s b. ICW to rate is IN 02:18:" 209/0/19 versim•S1 -A&i.ld: d 172.1'.12.1 ccsp IPS6.2 5. Tune the signature to alert only when the it sees three consecutive icmp echo request to 172.16.34.4 I $ Alerts. toø ccsp IPS6.2 6. Signature 2004 should now fire after six consecutive icmp echo requests ;however,the event counter should reset after 30 seconds. TEST. ccsp IPS6.2 7. Summarize alerts exceeding the threshold of two within 40 seconds. TEST. 1".t'.t2.tn ccsp IPS6.2 8. Set the global summary to engage when the number within the summa interval. TEST f alerts exceed 5 ccsp IPS6.2 9. Restore signature 2004 to its default settings. ccsp IPS6.2 : stepl (SPAN) monitor session I source vlan 2 rx monitor session 1 destination interfa FaO/ SWI monitor ession NdYSPAN Ingres': monitor session I source vlan 2 rx monitor session I destination interface FaO/20 ingress vlan 2 ccsp IPS6.2 : Step2 (Signature Wizard) 2 ccsp IPS6.2 : Step3 (Signature ID) ccsp IPS6.2 : Step4 (Engine 3 Off"' ccsp IPS6.2 : Step5 (Alert Response) 2 ccsp IPS6.2 : Step6 (Alert Behavior) ccsp IPS6.2 : Step7 (Edit PD) 第三部分 Signatures 配置实例实例二 10 」和以飞 CCSP IPS6.2 现任明教教主出品 Step8 （测试） 00 ， 0 1 ，邝《 0 到 3 飞《。飞《 CCSP IPS6.2 现任明教教主出品第三部分 Signatures 配置实例实例三： Add Sig 上半部分。地《、 “ · 酽，动的 0 飞石 0 1 一 0 鼾第三部分 Signatures 配置实例实例三 0 鈿灬 CCSP IPS6.2 现任明教教主出品 Add Sig 下半部分 ccsp IPS6.2 : Stepl (Select Engine) ccsp IPS6.2 : Ste 2 (Si nature ID) ccsp IPS6.2 • Step3 ccsp IPS6.2 : Step4 (Alert Response) ccsp IPS6.2 : Step5 (Alert Behavior 1) : step6 ccsp IPS6.2 (Alert Behavior 2) 第三部分 Signatures 配置实例实例四： Step7 CCSP IPS6.2 现任明教教主出品（测试） ccsp IPS6.2 UllfrJff*kDenied Attackers s.mr Hit