Thursday, 12 May 2011 20:58
Written by Administrator
Michael Ryan Corbin
Article 3 - Trojan detection using MIB-based IDS / IPS system
The final result of any application development or systems design is the implantation of the software. In the midst of reading about the procedures and general outlines for installation, I failed to read a mention of system security. Since most applications are installed on existing hardware I found the following article by Colin Pattinson and Kemal Hajdarevic to be most interesting. The authors tackle the possibility and certain threat of existing viruses and Trojans on end user PCs. Their article is entitled Trojan detection using MIB-based IDS/IPS system.
As a system analyst I would imagine that a threat of existing viruses on a newly developed system would be of great concern. A virus like a Trojan is exceptionally dangerous on a workstation and a network. The Trojan type virus has the ability to spread itself and open a portal on a workstation exploiting the vulnerability by opening a portal to allow other viruses to enter the workstation or network.
The main concern of an existing Trojan virus on a PC would be the opportunity it would have to access information on the new application loaded after the Trojan was installed. This would allow the virus to use its open portals within the workstation to access information in the application such as secure data. This could also leave the opportunity for a virus to alter the application from its original purpose and destroy data or worse share secure data outside the network. Most dangerously is the ability of a Trojan to be hidden from the user so that it could not be detected for days or months.
As explained in the article, an application often uses the workstation internal memory (RAM) to effectively run the program. A Trojan type virus could easily access this memory especially if it was preinstalled before the new application. As Trojans multiple they also use internal memory of the workstation. These viruses can overtake the RAM and limit the amount available to the rest of the programs on the workstation. Eventually it can become so powerful that a new application would not be able to function at all with the ultimate result of a PC that has no memory for basic functions. This leads to a “crash” of a computer making it completely unusable.
So the question becomes how do you detect a Trojan or eliminate it efficiently? Since Trojans are so hard to find what can be done to detect them early enough? Many of the more effective viruses can actually prevent antivirus programs or scanners to operate on the same workstation. The can easily disable basic functionality like opening a browser. The authors propose a simpler solution to third-party programs for detection and elimination. They propose using the information in the host computer memory – specifically the Management Information Base or MIB for short. Using such a system could become a proactive way to prevent viruses without using valuable resources to do so.
So how would MIB be useful? First of all MIB is where system information is stored. Information such as the hardware inside the PC, the connections to the network or outside (Internet), and running software is all collected inside the MIB. If you knew what was supposed to be in the MIB you could easily detect something that wasn’t supposed to be in the MIB. Sounds simple right? Actually it would take a fair amount of data and a way to process to see these changes to information inside the MIB. Storage isn’t the biggest issue but the way it transfers from one end to another is. The bandwidth between the host and the translator could be swamped by the transfer of this data which in turns takes away network speed and Internet usage. Because of the bandwidth issue intrusion detection only takes place periodically and apparently not often enough to be effective.
The answer is to keep the MIB observations on the local machine only. Instead of checking every process inside the MIB you can check certain ones which are smaller and are most likely to indicate an intrusion. One such process is the Host Resource called “HrSWrunName”. This is can be used to isolate a process to a local spot. Other useful ones might be “HrSWrunPerfCPU” which can see how much CPU is being used at one time to process a process. If there is a shift in either one it could be a Trojan. Both of them being affective is even more likely to be a virus. With these processes running locally it is possible to catch them sooner before they cause a bigger issue for the entire network or new application.
The authors continue their article by outlining a decision tree algorithm that would include a series of if/and/or situations to examine the changes in the MIB to determine if the threat is real or a false positive. The article concludes with time trials of processing times averaging 300 msec and next-step measures.
In conclusion I propose that a new step in application installation and launch be initiated. This new step would account for the possibility of foreign agents on the end user computer that might affect the usage and operations of the new application. User workstations should be inspected and cleaned using proactive techniques such as the MIB detection and other resources to ensure a sterile environment exists before a new application is installed or accessed.
References:
Pattinson, Colin, Hajdarevic, Kemal (2009) Trojan detection using MIB-based IDS / IPS system. Information, Communication and Automation Technologies, 2009. ICAT 2009. XXII International Symposium on IEEE, Digital Object Identifier: 10.1109/ICAT.2009.5348410, Page(s): 1 – 5, Accessed on 05/12/2011 from IEEE.org http://ieeexplore.ieee.org.ezproxy.liberty.edu:2048/stamp/stamp.jsp?tp=&arnumber=5348410