Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 0 down vote favorite

I am working on an IDS which has brought into the view of log analysis basically. I have to detect an intruder if there are any user behaviour anomalies present in the logs. I am having problems regarding setting rules for the Log Processing. So anybody with any suggestion about How to set the rules?

share|improve this question
1  
lol 3/3 posts to security.se have been asking the community to build this project for you. 1)sniff network, 2)???, 3)make money. – Rook Jan 24 '12 at 1:44
what IDS are you using ? What logs are you analyzing ? What type of anomalies do you wish to be alerted on ? – Mark McDonagh Jan 24 '12 at 10:47
@Rock : I think u should kknow abt me first that I am a student and trying to build IDS as a final year college project and not for any money....and I have already done some research if I wanted the rules then I could have got it from many other products like ossec.net.... – Pankaj Anand Jan 24 '12 at 16:37
@Mark : I am not using any IDS I just am implementing it from scratch...I am analysing system-level resource and application level logs... I need to know if there is any unauthorised login and use of applications... – Pankaj Anand Jan 24 '12 at 16:44

1 Answer

up vote 1 down vote accepted

As per my answer on your other post - have a look at the anomaly detection stuff over on the Snort forums. There are many aspects you will need to consider so try building on the work they have already done.

You will need to understand 'good traffic' for your network during the 'initial tuning' phase, use whitelists and blacklists of signatures, and then build heuristic analysis if you want to alert on deviation from the norm.

This is very resource-intensive, and complex to maintain, which is why many companies now outsource this entire piece to the big managed service providers.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.