Besides letting you set a threshold for the appropriate level of traffic allowed into a particular system, Top Layer Networks' Attack Mitigator IPS 5500 provides an interesting functionality called connection proxying that other NIPS products don't appear to have. Connection proxying lets you limit the number of incomplete TCP connections. An incomplete TCP connection usually indicates malicious activity, such as a SYN flood attack. Once the threshold for the number of allowed incomplete TCP connections is reached, Attack Mitigator works as a proxy between the sender and receiver. The connection packets will still come to Attack Mitigator, but it allows the traffic to continue to the destined computer only if the TCP connect completes (SYN, SYN/ACK, ACK packet sequence).
Depending on how you configure dedicated NIPS appliances, once the threshold for the appropriate level of traffic has been exceeded, they can throttle the traffic, drop packets entirely, reroute traffic, or send an alert to an administrator. Thus, you have an effective countermeasure for Denial of Service (DoS) attacks. The trick is to know how to properly calibrate a rate-based IPS so that the right level of protection is being provided and still not drop or reroute legitimate traffic. For example, what would be the acceptable number of packets that should be going to your DNS server, Web servers, and mail servers? An administrator would have to learn the correct thresholds through on-the-job training and continually tweak the IPS appliance until just the right amount of traffic is allowed to the different destinations.
Customers who implement rate-based NIPS appliances often complain that it's hard to determine the correct thresholds for host-to-host traffic and even port-to-port traffic. A few vendors provide the methodologies and tools necessary to monitor traffic so that you can set the correct thresholds, but this is rare. More often, vendors provide overly complex steps or send an engineer to create the baselines, which later might have to be recalibrated as the environment changes or traffic loads change.
Content based. Content-based NIPS appliances look for anomalous behavior and protocol anomalies to detect malicious payloads. Traditional IDSs work the same way, so content-based NIPS appliances don't represent a tremendous leap in ingenuity.
Content-based NIPS appliances look for anomalous behavior, such as FTP traffic going toward port 53, binary code within a user password, or an excessive number of bytes coming from a Web browser. In addition, they use signatures to look for protocol anomalies to identify packets that aren't compliant to specific protocol Request for Comments (RFCs). This has caused many false positives because many vendors don't choose to follow the protocol RFCs completely. Content-based IPS appliances also look for specific malicious protocol anomalies. For example, here are some potentially malicious modifications to the network and transport headers of a packet:
- incorrect length of header or field
- corrupt checksums
- incorrect TCP segmentation overlaps
- inconsistent use of flags within header fields
Some content-based IPS appliances dig deeper into the packet to look for potentially malicious activity within the application-layer headers. Application-layer protocol anomalies that can be detected include
- illegal protocol command usage
- unusually long or short field lengths, which might indicate a buffer overflow
- using a protocol for unusual purposes
- mapping a protocol to an unusual port number
- incorrect field values and combinations
Many content-based NIPS appliances are shipped with the same type of signature database you would find in IDSs. Because one of the biggest problems with IDSs is false positives, some IPS vendors have only about a fourth of their signature rules enabled out of the box. You can enable the other signatures as you see fit. As with rate-based NIPS appliances, content-based NIPS appliances can be configured to drop packets, reset connections, and even create a short-lived blacklist of IP addresses that are sending malicious traffic.
Some IPS products attempt to combine content-and rate-based features. However, it's difficult for one product to do both well at the same time because of the amount of resources required for these different types of packet inspections.
Register
