An example of communication between security tools: iptables - snort

ABSTRACT

Two of the most used tools in the area of computer security are the firewalls and the Intrusion Detection Systems. Both of them fulfill the task for which they were designed for but unfortunately their response to an attack can be limited. The communication of both tools increases the response capacity of the system, but we need a protocol to communicate them. In this paper we present how is to communicate two security tools: snort and Iptables. The communication is based on the Intrusion Detection Message Exchange Format (IDMEF) proposed by the Intrusion Detection Working Group (IDWG).

REFERENCES

• 1: Brian Caswell , James C. Foster , Ryan Russell , Jay Beale , Jeffrey Posluns, Snort 2.0 Intrusion Detection, Syngress Publishing, 2003
• 2: Russell, P. Rusty. Netfilter/iptables. November 2003. <http://www.netfilter.org>
• 3: Caswell, Brian y Marty Roesch. Snort: The Open Source Network Intrusion Detection System. November 2003. <http://www.snort.org>
• 4: Curry, David y Hervé Debar. Intrusion Detection Message Exchange Format Data Model and Extensible Markup Language (XML) Document Type Definition. January 2003. <http://www.ietf.org/internet-drafts/draft-ietf-idwg-idmef-xml-10.txt>
• 5: McAlerney, Joe. IDMEF XML plug in for the Snort IDS. January 2003 <http://www.silicondefense.com/idwg/snort-idmef/>
• 6: McAlerney, Joe y Adam Migus. Libidmef: C library implementation of the IDMEF XML draft. June 2002 <http://www.silicondefense.com/idwg/libidmef/index.htm>
• 7: Russell, P. Rusty. Linux iptables HOWTO. September 1999.
• 8: Andreasson, Oskar. Iptables Tutorial. April 2003.
• 9: Roesch, Martin y Chris Green. Snort Users Manual. 2003 <http://www.snort.org/docs/writing_rules/>
• 10: Bace, Rebecca y Peter Mell. "Intrusion Detection Systems". NIST Special Publication. SP800-31 November 2001 <http://csrc.nist.gov/publications/nistpubs/800-31/sp800-31.pdf>
• 11: Denise Draper , Alon Y. Halevy , Daniel S. Weld, The Nimble XML Data Integration System, Proceedings of the 17th International Conference on Data Engineering, p.155-160, April 02-06, 2001

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Data communications

Additional Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

  D. Software
  D.4 OPERATING SYSTEMS
      D.4.0 General

          Nouns: Linux
      D.4.6 Security and Protection
          Subjects: Information flow controls; Invasive software (e.g., viruses, worms, Trojan horses)

  K. Computing Milieux
  K.6 MANAGEMENT OF COMPUTING AND INFORMATION SYSTEMS
      K.6.4 System Management
      K.6.5 Security and Protection (D.4.6, K.4.2)
          Subjects: Unauthorized access (e.g., hacking, phreaking)

General Terms:
Security