Lecture Notes in Computer Science 2212 EditedbyG.Goos,J.Hartmanis,andJ.vanLeeuwen 3 Berlin Heidelberg NewYork Barcelona HongKong London Milan Paris Tokyo Wenke Lee Ludovic Mé Andreas Wespi (Eds.) Recent Advances in Intrusion Detection 4th International Symposium, RAID 2001 Davis, CA, USA, October 10-12, 2001 Proceedings 1 3 SeriesEditors GerhardGoos,KarlsruheUniversity,Germany JurisHartmanis,CornellUniversity,NY,USA JanvanLeeuwen,UtrechtUniversity,TheNetherlands VolumeEditors WenkeLee GeorgiaInstituteofTechnology,CollegeofComputing 801AtlanticDrive,Atlanta,Georgia30332-0280,USA E-mail:[email protected] LudovicMé SUPELEC BP28,35511CessonSevigneCedex,France E-mail:[email protected] AndreasWespi IBMResearch,ZurichResearchLaboratory Säumerstr.4,8803Rüschlikon,Switzerland E-mail:[email protected] Cataloging-in-PublicationDataappliedfor DieDeutscheBibliothek-CIP-Einheitsaufnahme Recentadvancesinintrusiondetection:4thinternationalsymposium; proceedings/RAID2001,Davis,CA,USA,October10-12,2001. WenkeLee...(ed.).-Berlin;Heidelberg;NewYork;Barcelona;HongKong; London;Milan;Paris;Tokyo:Springer,2001 (Lecturenotesincomputerscience;Vol.2212) ISBN3-540-42702-3 CRSubjectClassification(1998):K.6.5,K.4,E.3,C.2,D.4.6 ISSN0302-9743 ISBN3-540-42702-3Springer-VerlagBerlinHeidelbergNewYork Thisworkissubjecttocopyright.Allrightsarereserved,whetherthewholeorpartofthematerialis concerned,specificallytherightsoftranslation,reprinting,re-useofillustrations,recitation,broadcasting, reproductiononmicrofilmsorinanyotherway,andstorageindatabanks.Duplicationofthispublication orpartsthereofispermittedonlyundertheprovisionsoftheGermanCopyrightLawofSeptember9,1965, initscurrentversion,andpermissionforusemustalwaysbeobtainedfromSpringer-Verlag.Violationsare liableforprosecutionundertheGermanCopyrightLaw. Springer-VerlagBerlinHeidelbergNewYork amemberofBertelsmannSpringerScience+BusinessMediaGmbH http://www.springer.de ©Springer-VerlagBerlinHeidelberg2001 PrintedinGermany Typesetting:Camera-readybyauthor,dataconversionbyPTP-Berlin,StefanSossna Printedonacid-freepaper SPIN:10840834 06/3142 543210 Preface On behalf of the program committee, it is our pleasure to present to you the proceedings of the fourth Recent Advances in Intrusion Detection Symposium. The RAID 2001 program committee received 55 paper submissions from 13 countries. All submissions were carefully reviewed by several members of the program committee on the criteria of scientific novelty, importance to the field, andtechnicalquality.FinalselectiontookplaceatameetingheldonMay16-17 in Oakland, California. Twelve papers were selected for presentation and publi- cation in the conference proceedings. In addition, nine papers, presenting work in progress, were selected for presentation. The program included both fundamental research and practical issues: log- ging and IDS integration, attack modeling, anomaly detection, specification- based IDS, IDS assessment, IDS cooperation, intrusion tolerance, and legal as- pects. RAID 2001 also hosted two panels, one on “The Present and Future of IDS Testing Methodologies,” a subject of major concern for all IDS users and desi- gners,andoneon“IntrusionTolerance,”anemergingresearchareaofincreasing importance. Dr.BillHancock,SeniorVicePresidentandChiefSecurityOfficerofExodus Communications, Inc., delivered a keynote speech “Real world intrusion detec- tion or how not to become a deer in the headlights of an attacker’s car on the information superhighway”. The slides presented by the authors, the 9 papers which are not in the pro- ceedings, and the slides presented by the panelists are available on the website of the RAID symposium series, http://www.raid-symposium.org/. Wewouldliketothankallauthorswhosubmittedpapers,aswellasthepro- gram committee members and the additional reviewers, for their efforts. Special thanks go to Felix Wu for handling the conference arrangements, Niranjan Bal- walli for maintaining the paper submission Web site, Giovanni Vigna for publi- cizing the conference, and Andreas Wespi for maintaining the RAID Web pages and preparing the conference proceedings. Finally, we thank all the RAID 2001 sponsors. October 2001 Ludovic M´e Wenke Lee Organization RAID 2001 was hosted by and gratefully acknowledges the support of the Uni- versity of California at Davis, CA. Conference Chairs Executive Committee Chair: Marc Dacier (IBM Research, Switzerland) Program Co-chairs: Ludovic M´e (Sup´elec, France) Wenke Lee (Georgia Institute of Technology, USA) Publication Chair: Andreas Wespi (IBM Research, Switzerland) Local Organization Chair: S. Felix Wu (UC Davis, USA) Publicity Chair: Giovanni Vigna (UC Santa Barbara, USA) Program Committee Matt Bishop UC Davis, USA Joachim Biskup University of Dortmund, Germany Fr´ed´eric Cuppens ONERA, France Marc Dacier IBM Research, Switzerland Herv´e Debar France T´el´ecom R&D, France Yves Deswarte LAAS-CNRS, France Deborah Frincke University of Idaho, USA Anup Ghosh Cigital, USA Tim Grance NIST, USA Ming-Yuh Huang BoeingAppliedResearchandTechnology,USA Erland Jonsson Chalmers University of Technology, Sweden Richard Kemmerer UC Santa Barbara, USA Calvin Ko Network Associates, USA Baudouin Le Charlier Universit´e de Namur, Belgium Wenke Lee Georgia Institute of Technology, USA Richard Lippmann MIT Lincoln Laboratory, USA John McHugh CERT/SEI, Carnegie Mellon University, USA Roy Maxion Carnegie Mellon University, USA George Mohay Queensland University, Australia Ludovic M´e Sup´elec, France Abdelaziz Mounji Swift, Belgium Vern Paxson ACIRI/LBNL, USA Phil Porras SRI, USA Stuart Staniford Silicon Defense, USA Al Valdes SRI, USA Giovanni Vigna UC Santa Barbara, USA VIII Organization Andreas Wespi IBM Research, Switzerland S. Felix Wu UC Davis, USA Diego Zamboni Purdue University, USA Kevin Ziese Cisco Systems, USA Additional Reviewers Magnus Almgren SRI, USA Phillip Attfield BoeingAppliedResearchandTechnology,USA Salem Benferhat IRIT, Universit´e Paul Sabatier, France Paul Brutch Network Associates, USA Steven Cheung SRI, USA Ulrich Flegel University of Dortmund, Germany Frank Hill Cigital, Inc., USA Klaus Julisch IBM Research, Switzerland Vincent Letocart Universit´e de Namur, Belgium Emilie Lundin Chalmers University of Technology, Sweden Donald Marks NIST, USA Peter Mell NIST, USA Matt Schmid Cigital, USA Kymie M.C. Tan Carnegie Mellon University, USA Table of Contents Modeling Attacks From Declarative Signatures to Misuse IDS ........................... 1 Jean-Philippe Pouzol and Mireille Ducass´e Logging and IDS Integration Application-Integrated Data Collection for Security Monitoring .......... 22 Magnus Almgren and Ulf Lindqvist Interfacing Trusted Applications with Intrusion Detection Systems ....... 37 Marc Welz and Andrew Hutchison IDS Cooperation Probabilistic Alert Correlation....................................... 54 Alfonso Valdes and Keith Skinner Designing a Web of Highly-Configurable Intrusion Detection Sensors ..... 69 Giovanni Vigna, Richard A. Kemmerer, and Per Blix Aggregation and Correlation of Intrusion-Detection Alerts............... 85 Herv´e Debar and Andreas Wespi Anomaly Detection Accurately Detecting Source Code of Attacks That Increase Privilege..... 104 Robert K. Cunningham and Craig S. Stevenson CDIS: Towards a Computer Immune System for Detecting Network Intrusions......................................................... 117 Paul D. Williams, Kevin P. Anchor, John L. Bebo, Gregg H. Gunsch, and Gary D. Lamont Intrusion Tolerance Autonomic Response to Distributed Denial of Service Attacks ........... 134 Dan Sterne, Kelly Djahandari, Brett Wilson, Bill Babson, Dan Schnackenberg, Harley Holliday, and Travis Reid X Table of Contents Legal Aspects The Impact of Privacy and Data Protection Legislation on the Sharing of Intrusion Detection Information...................................... 150 Steven R. Johnston Specification-Based IDS Experiences with Specification-Based Intrusion Detection ............... 172 Prem Uppuluri and R. Sekar System Health and Intrusion Monitoring Using a Hierarchy of Constraints ....................................................... 190 Calvin Ko, Paul Brutch, Jeff Rowe, Guy Tsafnat, and Karl Levitt Author Index................................................... 205 From Declarative Signatures to Misuse IDS Jean-Philippe Pouzol and Mireille Ducass´e IRISA/INSA de Rennes - Campus Universitaire de Beaulieu 35042 Rennes Cedex, France {pouzol,ducasse}@irisa.fr Abstract. In many existing misuse intrusion detection systems, intru- sion signatures are very close to the detection algorithms. As a conse- quence, they contain too many cumbersome details. Recent work have proposed declarative signature languages that raise the level of abstrac- tion when writing signatures. However, these languages do not always comewithoperationalsupport.Inthisarticle,weshowhowtotransform such declarative signatures into operational ones. This process points out several technical details which must be considered with care when performing the translation by hand, but which can be systematically handled. A signature specification language named Sutekh is proposed. Its declarative semantics is precisely described. To produce rules for exist- ing rule-based IDS from Sutekh signatures, an algorithm, based on the construction of a state-transition diagram, is given. 1 Introduction Many formalisms and algorithms have been proposed to specify intrusion signa- tures in order to detect misuses. Among the intrusion detection systems (IDS) briefly described by Axelsson in [1], one can cite state-transition diagrams in STAT [8], colored Petri nets in IDIOT [10], condition-action rules in ASAX [7], expert systems in EMERALD [15]. The languages proposed in these articles are strongly dedicated to the underlying search algorithm. As a consequence, the signatures are cluttered with many operational details which make them hard to specify and maintain. Morerecentapproachesproposetospecifysignaturesofintrusionsinadeclar- ative flavor, for example MuSigs defined by Lin et al. [11] and LaDAA defined by G´erard [6]. LAMBDA, defined by Cuppens and Ortalo [4], and ADeLe, pro- posed by Michel and M´e [13], are languages dedicated to describe both attacks andsignatures.Theaimofallthesehigh-levellanguagesistospecifysignatures, regardless of any detection process, by describing relations between events in an audit trail. However, either these languages ignore functionalities provided by others, or they do not offer any operational support. This article firstly proposes Sutekh, a declarative signature language provid- ing a combination of functionalities at least as complete as the union of what is offered by other declarative systems. In addition, we show how to produce operational detection rules from declarative signatures. W.Lee,L.M´e,andA.Wespi(Eds.):RAID2001,LNCS2212,pp.1–21,2001. (cid:1)c Springer-VerlagBerlinHeidelberg2001