How can an IPS\IDS detect SQLi \ XSS (or other application layer) attacks?

Question

I've been thinking about how an IPS works, and as far as I know it inspects the packets on the TCP\IP layer.

How can it detect attacks on higher levels without harming the user experience? How does it address the fact that there is a loss of information and re-transmissions?

In the end, there could be a long request that splits over a few TCP packets. Does it build the information and then run a check on the request?

I would like to know what happens from network level and forward.

Thanks.

Answer 1

An IPS just does the same TCP reassembly as the stacks on either end.

Retransmissions aren't a problem. When a hole appears in traffic (because of a lost packet), the IPS forwards the packets after that hole, but also keeps a copy of them. Because it's forwarding those packets, there is no loss in user experience.

When the retransmitted packet fills the whole (completing the puzzle), the IPS then analyzes all those stored packets in order. It combines these into a single stream, so requests split across packets are no problem. If any of those packets trigger a signature, the IPS blocks the retransmitted packet, and kills the TCP connection with RST packets. This caused the target victim to then drop the fragments after the hole that it was buffering.

Thus, packets stream through the IPS with essentially zero latency, but at the same time, TCP is reassembled with no problem.

Over the last decade, hackers have developed methods to attack this system, such as retransmitting TCP segments with different data. Likewise, IPS vendors have developed defense, such as matching their reassembly algorithms with the target system so that it can choose the correct segment to analyze.

Also note that the IPS does full HTTP processing as well. There are likewise ways of corrupting HTTP requests in order to evade the IPS, which IPS vendors defend against.

The upshot is that an IPS introduces only about 100-microseconds (or 0.1 milliseconds) in latency to web requests, while still handling such things as TCP reassembly with no problem.

Answer 2

I think what you are looking for is a Web Application Firewall (WAF) [OWASP discusses this here] IPS\IDS work further down the stack to look at traffic flow instead of what is being passed at the application layer.

WAF works at a higher level in the stack to filter out conversations that meet patterns that are deemed to be harmful, including SQLi and XSS.

In *nix environments, there is ModSecurity that is standard. There are multiple commercial appliances that are also available from Cisco, Checkpoint, F5, Fortinet, SonicWall, etc.