PDF of this tutorialTraditionally, illegal network intrusions are dealt with by access-control devices such as firewalls and radius and authentication servers. However, these are not useful against the many new types of fraud devised for IP–based NGNs. The purpose for which these devices were built is highly specific and noninclusive of IP fraud possibilities; each is designed to support a single protocol (typically IP), limited to a single location, and secures only one part of the network. A firewall provides preliminary filtering of unauthorized traffic to specific resources or network segments, and a typical firewall classifies traffic on the basis of IP addresses, which are by nature unreliable. Authentication and authorization mechanisms (AAA servers, radius) restrict access to the network and its resources, enabling usage only when provided with a legal user identification and password. However, user identifications and passwords are easily obtained or guessed and therefore a user connecting to a network or service is not necessarily who he claims to be. Network intrusion detection systems (N–IDS) limit attacks on specific protocols by intercepting malicious packets and streams to particular hosts; and host-based intrusion detection systems (H–IDS) limit application-targeted attacks by intercepting malicious activity at the operating system and application levels. However, both address IT—not network—security and will not recognize fraud techniques and patterns that affect network operators.
As IP fraud may be performed from multiple points in the network simultaneously, or alternately between several different but recurring points, the successful detection of fraudulent activity requires constant exchange of information between all network elements, devices, and interfaces, followed by the comparison and analysis of all data traffic flowing through the network. Existing network elements and security mechanisms lack the ability to communicate valuable information between them, requiring the intervention of an intelligent "liaison" to monitor all interconnection points and collect, process, and distribute relevant data and ensure that all possibilities of intrusion have been covered.
