IDS-based Passive Asset Detection

Abstract

Computer networks are growing in complexity and size, making it challenging to keep an inventory of computers and their software operating in a network. Traditional solutions to this problem, like active scanning or soft- ware agents on individual hosts cannot function in all environments and can incur traffic overhead in the network or processing overhead on the network hosts - and are therefore not the best solution in all environments. This Master s project has investigated the potential of using the power of Intrusion Detection Systems, more specifically the IDS Bro, for asset detection. The resulting system is passive, and therefore does not incur any network traffic overhead, nor does it incur any processing overhead on the monitored hosts. The thesis investigates techniques for gathering fingerprints relevant to an IDS asset detection system, and describes a proof of concept implementation to demonstrate the usefulness of this method.