Intrusion Detection System, a system for detecting and alerting based on behavior.

learn more… | top users | synonyms (2)

0
votes
0answers
10 views

VM Introspection on Public IaaS clouds

I came across this Security SE post and a few papers on VM Introspection [1] [2] [3] What prevents cloud providers like AWS from using techniques like these to observe EC2 instance activity? If they ...
1
vote
1answer
26 views

Scan detection Tool better than Snort Portscan Preprocessor

I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor to detect different ...
0
votes
0answers
12 views

Pulledpork not disabling all rules in disablesid.conf [closed]

Every time I run pulled pork, it disables 6 random rules from my disabledsid.conf and leaves the rest alone. I have hundreds of rules in the disablesid.conf and the path is correct. IE: # example ...
0
votes
0answers
28 views

How do you receive Clone Pool traffic on a Linux IDS server?

we use IDS servers with suricata on a standard Gentoo Linux. One sensor is supposed to process traffic from F5 network devices, and there is a Clone Pool configured. Clone Pools are the recommended ...
-2
votes
2answers
55 views

Limit possible harm of ransomware on a fileserver

First to say: I know I need a backup and I have one of course but my question isn't about the safety of the data but about how to reduce the possible time that is needed to restore data. I'm already ...
3
votes
2answers
235 views

Detecting when a screenshot is taken by a software (spyware) in Windows [closed]

Most trojaning, spyware and keylogger tools have the ability to take screenshots. Is there a way to detect if an app or software is taking a screenshot in Windows? Maybe a Windows API call or dll? ...
0
votes
0answers
25 views

Process of auditd -s enable/disable persists for a long time

I have setup auditd on my system, with some basic rules from CIS Benchmark paper and the following auditd.conf file: log_file = /var/log/audit/audit.log log_format = RAW log_group = root ...
5
votes
1answer
71 views

Detecting Process Hollowing

I was brainstorming methods of detecting process hollowing and other forms of code injection, and this one seemed pretty robust. Would it be possible for a "process hollowing scanner" to enumerate ...
1
vote
1answer
112 views

Raspberry Pi IDS/FireWall - Should I? [closed]

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
2
votes
2answers
150 views

How can the nmap tool be used to evade a firewall/IDS?

Some techniques are used to secure the operating system against network attacks e.g.: firewalls, antivirus software, an IDS like SNORT, etc. To take advantage of the nmap tool, is it possible to ...
1
vote
2answers
49 views

What are the technical implementation differences between signature-based scanning and heuristic-based scanning?

Signature-based scanning works by comparing something to a database. So does this basically amount to scanning a file x for string foobar? I know heuristic-based scanning can detect new threats that ...
1
vote
2answers
30 views

Snort Unable to detect portscans in LAN

Setup Information I am doing experiment on portscan detection using snort 2.9.8.I have 10 systems in my lab with id:1,2,3,...,10. i have installed snort in my lab-pc with id:1.Now i am using Pc with ...
2
votes
1answer
63 views

Tap-mode IPS vs IDS

It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks. In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
1
vote
0answers
43 views

Inconsistent duplicate TCP packets

How often does it happen that we benignly see a TCP packet that is retransmitted but has a different payload the second time? In other words, how often is it that we see a TCP packet with sequence ...
2
votes
0answers
64 views

Snort Portscan Preprocessor Analysis

Remarks I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
0
votes
3answers
90 views

How does a hack leave no trace in server logs when there is a WORM IDS?

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)? If an IDS is monitoring the ...
1
vote
0answers
51 views

Network configuration for Security Onion on VMWare ESX

I'm setting up an IDS using Security Onion on VMWare ESX. I have a VLAN from the (physical) switch which has the network SPAN port; this is feeding into the ESX virtual switch, and this port group is ...
0
votes
1answer
94 views

Understand how dionaea honeypot emulated services work

I'm trying to understand Dionaea honeypot and the information flow. I understand that it emulates some services, like SMB, ftp, tftp, try to responde with these, then gets the shellcode and ...
4
votes
1answer
68 views

Basic question about how an IDS works

Would the location of an Intrusion Detection (or Packet Analysis) sensor on an internal network impact whether the external host's Source IP (assuming inbound TCP traffic) is retrievable from a packet?...
1
vote
0answers
33 views

Is there an easier way to test suricata has enough resources to run without losing packets?

I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and ...
19
votes
4answers
2k views

Detect non HTTP packets using port 80

We are currently doing port whitelisting on our firewalls which is working well but this of course does not prevent the implementation of side channels or the misuse of these ports for other purposes. ...
2
votes
1answer
82 views

Linux (!) Network Architecture for CTF-scenario [closed]

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
0
votes
2answers
100 views

Distinction of DPI and IDS

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in ...
0
votes
1answer
176 views

(spp_sdf) SDF Combination Alerts in Snort

I'm testing Snort in IDS mode and have been receiving a few (spp_sdf) SDF Combination Alerts as below. Seems like it happens when I visit certain but not all https sites. Tried to google this alert ...
1
vote
1answer
85 views

Are snort rules applied per packet or per flow

I would like to understand if snort rules are applied for each packet in a flow between a source and destination separately? For instance, when packet 1 of the flow arrives at the IDS, all the rules ...
0
votes
1answer
77 views

snort rule to detect relay attempt not working

I am trying to detect a relay attempt on smtp server, but nothing gets logs when I test it out. The snort rule to detect a relay attempt which I tried using is: alert tcp $SMTP_SERVERS 25 -> ...
0
votes
0answers
25 views

Snort matching against single packets

For a specific task, I'd like to match snort rules against the first 1-2 packets of each flow in the network without waiting for the other subsequent flow packets. Can I do this with snort? If so, how?...
0
votes
1answer
77 views

Do I need ossec for my personal home computer? [closed]

Do I really need a HIDS like ossec, or will using good passwords, using a firewall, an antivirus/antimalware program, and a rootkit scanner do the job well enough?
0
votes
0answers
157 views

Suricata IPS manual blocking/unblocking vs. snort and guardian

Does anyone have experience with using Suricata as an IPS? Im on Debian and I'd like to be able to manually block and unblock specific ip addresses (iptables). I've not used Suricata as I am currently ...
-1
votes
1answer
162 views

Which method is the best for IDS : heuristic or signature based? [closed]

In signature based IDS: it maintains a database of the signatures that might signal a particular type of the attack. Problems: New attack that has been specifically constructed in order to not ...
0
votes
0answers
18 views

Current Decryption Support for TLS [duplicate]

I've been locking things at clients down recently and ran into a side effect I hadn't really thought about were TLS traffic using DHE based ciphers can't be decrypted with SSLDump or Wireshark. I ...
4
votes
2answers
531 views

What is the difference between a HIDS/HIPS and an anti virus?

I have gone through what IDS/IPS's are. I understand the difference between a NIDS/NIPS and a HIDS/HIPS. But Host IDS and Host IPS sound like an antivirus software to me, is there a difference?
5
votes
1answer
321 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
5
votes
1answer
104 views

Using a single number instead of an IP address or a DNS name, which are concrete uses? [closed]

My question: I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to ...
1
vote
0answers
40 views

What kinds of features are useful for network security visualization? [closed]

I just want to know is network security visualization are practical for enterprise network administrators? (Which I am not) And if it is what kind of tools they uses and what kind of features they are ...
1
vote
2answers
115 views

How eavesdropping attack takes place in network

I am learning some concepts of network security and I have the following question: One case of eavesdropping attack is that an adversary somehow places himself inside a network to order to capture ...
3
votes
1answer
91 views

Detecting botnets that use HTTP instead of IRC

I know most bots use either IRC or HTTP to communicate with the C&C, and http unlike IRC can't be blocked. So if a botnet is using HTTP, how can this be prevented? Just theoretical!
3
votes
1answer
75 views

How to make Snort not log sensitive data from the sniffed traffic?

I have Snort in my network which I use for IDS and it is residing on a VM that receives all mirrored traffic from the switch. I am having a web applications that users use and they login, operate on ...
0
votes
0answers
99 views

Snort arpspoof preprocessor not giving alerts

I'm attempting to use Snort to detect a simple arpspoof attack on a test network I've set up. I have the following 4 ip addresses on this network. 192.168.1.1 Router 00:18:39:EC:F5:78 192.168.1.2 ...
1
vote
1answer
237 views

Suricata rule to block particular website question

I am writing rule for suricata which is going to block the possibility to enter one of the website for example xyz.com (instead of facebook, because with facebook there are some problems). I am doing ...
2
votes
3answers
102 views

Multiple SSL Inspection

I want to ask you if you think that doing SSL Inspection in proxy mode (Resign) could be a problem. The scenario is the following: 1 --> 2 --> 3 Client web browsing IPS device with SSL ...
0
votes
0answers
69 views

Snort rule to detect More Fragments fragbit not working

I have a Virtualbox setup with Snort running on a Windows 7 host and Kali Linux as the attacking machine, connected on an internal network. I'm investigating ways to get Snort to detect fragmentation ...
0
votes
0answers
80 views

Is EasyIDS obsolete?

I have found EasyIDS from Skynet Development recently but noticed that the latest change-log is from 2009. Does this mean it is obsolete and should not be used as it is not being kept up-to date?
0
votes
0answers
105 views

Switching from Snort rules to Emerging Threats. Is there a way to know which ET rule sid covers the same vulnerabilty as Snort rule sid?

Our company has been using the snort community rules and we have tuned our rule files over years to our specific needs. Now our company has decided to use Emerging Threats (ET) open rules. The ET ...
0
votes
1answer
91 views

fwsnort - How safe compared with Snort/Suricata?

How safe is 'fwsnort' compared to a real Snort / Suricata instance? What's the percentage of VRT / ET Rules, that fwsnort can actually use? I read somewhere from an older article its only ~ 60% - is ...
6
votes
1answer
741 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
1
vote
0answers
11 views

Adding Windows 7 VM as a log source/forcing the IDS inline

I'm investigating ways to add my Windows 7 VM as a log source or even run that traffic through my IDS VM and then out to the internet but I'm not entirely sure how to approach it. Does anybody have ...
1
vote
1answer
17 views

IDS device behaviour

Which of the following is a reasonable response from the ids when its detects ip packets where ip source address and port is the same as the destination IP address and port A. Allow the packet to be ...
1
vote
0answers
16 views

get session data (stream data) into Snort ids [closed]

Can any one point to me where (in the code) Snort are stored just before they send to httprespect or got written to the output files? Thanks.