Detect attacks and intrusions by monitoring your network for abnormal traffic, regardless of the actual content.
Most NIDSs monitor the network for specific signatures of attacks and trigger alerts when one is spotted on the network. Another means of detecting intrusions is to generate a statistical baseline of the traffic on the network and flag any traffic that doesn’t fit the statistical norms. One intrusion detection system of this type is the Statistical Packet Anomaly Detection Engine (SPADE).
SPADE is actually a modified version of Snort that extends its functionality into the realm of anomaly-based intrusion detection. The SPADE preprocessor uses Snort to monitor the network and constructs a probability table based on the traffic that it sees. It then uses this table to generate an anomaly score of between 0 and 1 for each packet (0 is definitely normal, and 1 is a definite anomaly).
Installing SPADE is easy. Just download the pre-patched source distribution, which includes the Snort and SPADE source code, unpack it, and change into the directory that it created. Now compile and install Snort [Hack #106] as you normally would.
Once you’ve done that, you’ll need to configure Snort to use SPADE. You have two choices here: you can set it up to use only SPADE functionality or to use normal Snort functionality along with SPADE. For the former, you can use the spade.conf file located in the SPADE source distribution as a starting point.
Most of the defaults are fine. However, you will need to set the SPADEDIR variable to a place where Snort has read and write access:
var SPADEDIR /var/log/snort/spade
SPADE will keep various logs and checkpointing information here so that it does not lose its probability table whenever Snort is restarted.
It is also important that you tell SPADE what network is your home network. You can do this by using a line similar to this one in your configuration file:
preprocessor spade-homenet: 192.168.1.0/24
You can specify multiple networks by separating them with commas and enclosing the list in square brackets.
If you want to run Snort with SPADE and traditional Snort functionality, you can just include your spade.conf in your snort.conf with a line like this:
include spade.conf
Run Snort just as you did before. SPADE will now send its output to any of the output plug-ins that you have configured when it detects anomalous behavior. This is triggered when a given packet’s anomaly score is in the range .8 to .9 (it depends on the type of packet). Any
alerts generated by SPADE will be prefixed with Spade: and will include a description of the packet’s deviant behavior and its anomaly score.