Improving Network Security Using Elliptic Curve Cryptosystem

v.    Personal Firewall)s:
➢    Workers may be connected to corporate networks from their home PCs by: High-bandwidth mechanism – DSL, cable modems or VPNs for remote connections.
➢    What happen if home PCs are compromised and used as launching point for attacks on the corporate networks?
➢    This is why companies have to consider about the personal firewalls as a part of their total security solutions.
➢    Personal firewalls can software products that protect a particular desktop machine, or they can hardware applications that protect a home network.
They perform a variety of functions:
➢    Packet filtering based on port and source address
➢    Logging and alerting of attacks
➢    They sometimes allow for remote management. This feature enables a company to centrally manage and administer rule sets.
B. Intrusion Detection Technology
i.    What is an intrusion
An intrusion is a security event in which someone attempts access to systems or information that they would not normally be allowed to see. This behavior can be quite similar, whether this person is entering (or trying to enter) from outside a network, or a legitimate local user misusing access privileges. Similarly, Denial of Service attacks, which render a system or service unavailable, are another common type of attack commonly called an intrusion.
ii.    Intrusion Detection System:
It refers to the intrusion detection and real-time monitoring of the reporting system, mainly by the sensor, analyzer, manager, and user interface component. It gather information from a different source systems and networks (including the internal network information and network information from the outside), and then according to known attack patterns of the information analyzed to check whether there are signs of invasion. It can completely track the user's activities, identifying users who violate security policy activities; to provide expert system, automatic configuration of the system consistency check and diagnosis, monitoring and analysis of data packets to identify the same pattern with the known activities of the invasion. According to the object monitoring system, intrusion detection systems can be divided into network-based intrusion detection and host-based intrusion detection.
Host-Based: which monitors the characteristics of a single host and the events occurring within that host, for suspicious activity.
Network-Based: which monitors network traffic for particular network segments or devices and analyzes the network and application of protocol activity to identify suspicious activity. Hybrid: In this type both kinds of IDS can be used simultaneously.
Network Behavior Analysis (NBA): which examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware, and policy violations (e.g., a client system providing network services for other systems)
An IDS uses one or both of the following techniques to detect intrusions:
➢    Signature detection—the IDS scan packets or audit logs to look for specific signatures (sequences of commands or events) that were previously determined to indicate a given attack’s presence.
➢    Anomaly detection—the IDS use its knowledge of behavior patterns that might indicate malicious activity and analyzes past activities to determine whether observed behaviors are normal.
ii.    ID System Components
The functionality of an IDS can be logically distributed into three components: sensors, analyzers, and a user interface.
•    Sensors
Sensors are responsible for collecting data. The input for a sensor may be any part of a system that could contain evidence of an intrusion. Example types of input to a sensor are network packets, log files, and system call traces. Sensors collect and forward this information to the analyzer.
•    Analyzers
Analyzers receive input from one or more sensors or from other analyzers. The analyzer is responsible for determining if an intrusion has occurred. The output of this component is an indication that an intrusion has occurred. The output may include evidence supporting the conclusion that an intrusion occurred. The analyzer may provide guidance about what actions to take as a result of the intrusion.