CND (312-38) Network Defense Simulation
In this simulation, you will analyze network traffic patterns and understand how different Intrusion Detection Systems (IDS) identify threats. You will learn the distinction between pattern matching and baseline deviation in network monitoring.
Network Scenario
Sam is a network administrator for a mid-sized financial firm. The company's perimeter firewall is successfully blocking unauthorized ports, but malicious traffic is still traversing allowed ports (like TCP/80 and TCP/443). Sam needs to deploy a sensor at the network perimeter that can quickly and accurately drop alerts for known malicious payloads—such as specific byte sequences of an Apache exploit or SQL injection strings—with low false positives.
To accomplish this, Sam evaluates several open-source IDS engines, looking specifically for one that excels at inspecting packet payloads for predefined static indicators of compromise (IoCs).
Traffic & Logs
Proposed IDS Rule Syntax (Snort/Suricata format):
alert tcp $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"MALWARE-CNC Win.Trojan.Zeus variant outbound connection"; flow:to_server,established; content:"GET /config.bin HTTP/1.1"; http_uri; content:"User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1)"; http_header; classtype:trojan-activity; sid:1000001; rev:1;)
Analysis: The rule above uses the content keyword to look for an exact string (pattern) within the HTTP URI and Header of a packet. If the network traffic contains these exact byte sequences, the IDS will generate an alert.
Question
Sam wants to implement a network-based IDS and finalizes an IDS solution that works based on pattern matching. Which type of network-based IDS is Sam implementing?
Expert Analysis
1. What is happening in the network
The network is exposed to known threats traversing open firewall ports. To detect these, the defender needs a mechanism that inspects the payload of the packets for specific malicious characteristics, rather than just looking at IP addresses and port numbers.
2. Identify attack or behavior
We are identifying the implementation of a Detection Control. Pattern matching specifically looks for known bad byte sequences, such as shellcode, malware command-and-control strings, or standard web application attack vectors (like ' OR 1=1 --).
3. Why correct answer (C) is correct
Signature-based IDS (C) relies entirely on a database of known "signatures" or "patterns" of malicious traffic. When incoming network traffic matches a signature in the database, the IDS triggers an alert. Because Sam's solution works based on "pattern matching," it is by definition a Signature-based IDS.
4. Why others are wrong
- Behavior-based IDS (A): Monitors for deviations from normal user or system behavior (e.g., a user logging in at 3 AM when they usually log in at 9 AM), rather than matching static packet payloads.
- Anomaly-based IDS (B): Establishes a mathematical baseline of "normal" network traffic (e.g., standard bandwidth usage, typical protocol ratios). It alerts on statistical deviations (like a sudden spike in DNS traffic), not specific patterns.
- Stateful protocol analysis (D): Examines protocol states against RFC vendor specifications. It checks if the protocol is behaving correctly (e.g., ensuring a TCP handshake completes before allowing data transfer), rather than searching for specific malware strings.
5. Defensive Action
Implement a NIDS like Snort or Suricata configured with up-to-date threat intelligence feeds (e.g., Emerging Threats or Talos rulesets). Ensure a scheduled task is running (like Oinkmaster or PulledPork) to automatically update the signature database daily, as signature-based systems are blind to new (zero-day) threats without an updated pattern.
MINI LESSON: Detection Methodologies
Network defenders must layer their detection strategies because no single method is perfect:
- Signature/Pattern: High accuracy, low false positives. Weakness: Cannot detect zero-days (unknown attacks).
- Anomaly/Heuristic: Can detect zero-days by spotting unusual traffic volumes. Weakness: High false positives (legitimate traffic spikes cause alerts).
Explore more CND simulations
Go to Practice Tests