Intruder classes, the attack methodology, and what an IDS is

Two taxonomies, and you need both

This is the one place in the course where the current textbook and the paper you will sit disagree, so take the disagreement head on.

### The classical taxonomy (not in the current text)

The older classification, which goes back to Anderson's 1980 report on audit-based intrusion detection and was carried by earlier editions of this course's textbook, sorts intruders by their relationship to the system:

• A masquerader is not authorised to use the computer at all. They penetrate the access controls and operate a legitimate user's account. Typically an outsider.
• A misfeasor is a legitimate user. They access resources they are not authorised for, or they misuse privileges they legitimately hold. Typically an insider.
• A clandestine user takes over the system at administrator level and turns that power on the monitoring itself — stepping around the access controls and switching the audit trail off, or scrubbing what it already recorded. They may be an insider or an outsider — that is the axis's one crossover.

All three descriptions sound like "somebody doing something they should not", which is exactly why the three-way is a perennial exam question. The discriminating question is never what did they do but what was their standing before they did it: none, legitimate-but-exceeded, or elevated-to-supervisory.

### The current taxonomy (in the text)

The fifth edition dropped that scheme and classifies intruders by motivation instead:

• Cyber criminals — financial reward. Identity and credential theft, corporate espionage, ransoming data.
• Activists (hacktivists) — social or political causes. Note the counterintuitive part: skill level is often quite low, because the aim is publicity, and a defacement or an outage generates as much of it as a theft would.
• State-sponsored organisations — often labelled APTs, for the covert and persistent character of the campaigns rather than for any special technique.
• Others — technical challenge and peer esteem. This is also the recruiting pool for the first three.

On a separate axis entirely, skill sorts into beginner (script kiddies running existing toolkits — the largest group and, precisely because the tools are known, the easiest to defend against), skilled (able to modify and extend toolkits, and to package them for others), and expert (finding entirely new categories of vulnerability).

A useful counting fact: roughly four fifths of investigated breaches involve outsiders and a little under a fifth involve insiders — but insiders account for a small number of very large compromises, so counting incidents and counting damage give opposite answers.

Worked example — one intrusion, six steps

Follow a single attack against a mid-sized firm.

1. Target acquisition and information gathering. The attacker reads the company website, pulls DNS and WHOIS records, and runs a port and service scan. They even read the headers of a reply from customer service, which reveal the mail client and the operating system. Nothing illegal has happened yet, and nothing has touched a system that would log it as an attack. At this stage the attacker has no standing at all — in the classical taxonomy, they are a would-be masquerader.
2. Initial access. A remote vulnerability in an exposed service, a weak or reused credential, a phishing message, a drive-by download, or a supply-chain compromise of a package the firm installs. Say a reused password on a VPN account works. The attacker is now operating a legitimate account without authorisation — a masquerader, exactly.
3. Privilege escalation. The VPN account is an ordinary user. The attacker uses a local vulnerability — an unpatched kernel, a badly configured SetUID binary — to become root. This is the moment the classification changes.
4. Information gathering or system exploit. Now they read what they came for, or pivot to another host using credentials captured on this one.
5. Maintaining access. A backdoor, a covert account, a changed configuration, so that a password reset does not evict them.
6. Covering tracks. Edit the audit logs, install a rootkit to hide the processes and files. This is the clandestine user in the classical sense: supervisory control used to defeat the auditing.

Each step has a defence, and they are different defences. Reconnaissance is answered by publishing less. Initial access by patching, multi-factor authentication and user training. Escalation by least privilege and prompt local patching. Exploitation and pivoting by network segmentation. Maintenance by file-integrity checking. Track-covering by shipping logs off the host as they are written, because a log an attacker can reach is a log an attacker can edit.

What an IDS is

A security intrusion is getting past a system's security mechanisms without authorisation. Read that definition carefully: it is defined as the act of bypassing, not as damage done. An intrusion has occurred even if nothing was taken.

Intrusion detection collects information from assorted places and analyses it for evidence of such acts. Every IDS, however it is packaged, has the same three logical components:

• Sensors collect data — packets off a segment, log records, system-call traces, file checksums. Anything that could hold evidence.
• Analysers take input from sensors, or from other analysers, decide whether an intrusion has occurred, and may recommend a response.
• The user interface — variously called the manager, director or console — is how a human sees and steers the system.

And there are three types, distinguished by where the sensors sit:

• HIDS, host-based: one host's own activity, its processes and the system calls they make.
• NIDS, network-based: traffic on one or more segments, examined at the network, transport and application layers.
• Distributed or hybrid: both, correlated centrally.

The sentence that justifies having both: a HIDS can detect an intrusion carried out entirely inside the host by someone already authorised to be there; a NIDS and a firewall cannot. That is the answer to "why not just buy a bigger firewall".

Three motivations for running one at all are worth naming, because only the first is obvious: eject the intruder before damage is done; act as a deterrent, which makes detection a form of prevention; and collect intelligence about techniques, which improves the prevention you deploy next year.