Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What are the main classification of attacks in network and specially in Snort IDS?! Is it possible to power up the Snort by classifying the attack into for 5 main groups, for example; R2L, U2R etc. What snort does in detecting the attack?

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

All snort rules are categorised. Please see here - http://blog.snort.org/2012/03/rule-category-reorganization.html.

share|improve this answer
    
Yeah, for sure!! I just read it before, but i want to know these categories for some attacks like U2R, R2L, spoofing and etc. And also the old categories will be changed to protocols and files based!! but my question is that, Is there any category behind these categories for famous attacks or not?!! –  Mohsen Gh. May 16 '12 at 18:25
    
So by U2R you're looking for privilege escalation type attacks, well they're system/application specific depending if either has a vulnerability and R2L equates to some sort of vulnerability that can be exploited to obtain local access via a remote exploit (I wouldn't call them famous). They're generic descriptions and you'll see Snort is (and will be) categorised based on protocol (vulnerabilities), types of client-side attacks (based on file types), policy or indicators (e.g. compromise). This evolution of categories will continue for quite a while from what I can see. –  Mark Hillick May 16 '12 at 20:36
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.