Intrusion Detection Systems

learn more… | top users | synonyms (2)

1
vote
1answer
20 views

Using snort with cloudflare? [on hold]

How might Snort or another IDS system work with Cloudflare? Essentially, the originating IP would be CloudFlare's, therefore a proactive IPS might be difficult to install. I understand that ...
1
vote
3answers
100 views

Why Bash Shellshock vulnerability cannot be detected at webservers in advance?

There are lots of posts regarding the shellshock vulnerability. I can understand the vulnerability in detail. However, I'm curious about why any Intrusion detection system or host-based tools (e.g., ...
1
vote
1answer
55 views

What could this set of IDS alerts be (DDNS deaftone.com darktech.org chatnook.com, …)?

Below is a screeny of my Squert GUI showing the Snort events. Notice they all happen at the same exact time. I cannot figure out what the source of it could be. Any ideas? Edit: It looks like the ...
2
votes
1answer
82 views

Snort IDS for Amazon deployment

Is Snort a good choice for monitoring network and web application traffic on Amazon EC2? If not, why and what IDS would you suggest? Is Snort a good choice to monitor for XSS, Sql Injection, attempt ...
0
votes
0answers
26 views

Possible to run snort without modifiers?

Is there anyway (e.g some command line argument) with which we can tell snort to run and perform detection but without caring for the rule modifiers if there are any ? e.g alert tcp any any -> ...
-1
votes
1answer
36 views

Recommendations for installing OSSIM

I'm an apprentice in web security and I was assigned with the task of researching about OSSIM. Bear with my infinite ignorance as I take my questions to the stack exchange gurus. What I know so far: ...
1
vote
2answers
91 views

List of security products for my network [closed]

We are building and environment where mostly open source and trial versions would be used first before we purchase any product. I need your recommendation on the tools required to build a network that ...
0
votes
0answers
48 views

OSSEC not detecting deleted files?

I have configured 3 VMs: ossec server and two agents in CentOS 6 and Windows 2k8 R2. I have completed the setup and FIM and Log Management works smoothly. It also reports the new files. However, it ...
-1
votes
2answers
154 views

What are the difference between IPS and WAF in terms of DDoS?

I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?
1
vote
0answers
20 views

I want to filter Snort rules by date written

I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?
1
vote
2answers
99 views

IDS across seperate AWS accounts

I have 2 separate AWS accounts and I would like to a Vuln scanner/IDS on one to scan another. One environment is a regular AWS account and the other is in AWS Gov Cloud. Due to limitations within ...
1
vote
1answer
139 views

How to detect/mitigate UDP port scan using OpenBSD and pf

One of our OpenBSD firewalls experienced a flood of UDP traffic from a compromised host within our internal network. The traffic was exchanged between the compromised internal host and a single ...
0
votes
3answers
237 views

Why do we need IDS/IPS if a firewall is present?

Why do we need IDS/IPS if a firewall is present?
0
votes
1answer
59 views

Why does IBM's Intrusion Detection System Show Local IPs instead of Public IPs for the Source of an Attack?

Security Intern here given the assignment to find the IP address of an attacker using IBM's IDS. The event or attack in question is entitled X509_Weak_Signature_Algorithm, and from what I ...
0
votes
1answer
88 views

Snort Rule Comparison

As far as I read, Emerging threats and VRT Snort rules are available freely, and also Pro (fee based). Is there any comparision, or anything to suggest choose one over another? What are the benefits ...
2
votes
1answer
63 views

Anomaly intrusion detection

Anyone know which opensource network IDSs are using anomaly techniques? My project is to compare them, so if you could give me some hints, that would be much appreciated. Currently, I am looking at ...
0
votes
1answer
61 views

HIDS that can detect attacks, take immediate action locally, and then report to a central service for re-broadcasting to other systems?

I've been researching this for a bit now and cannot find what I want. So I'm to the point where I'm weighing my options as to how I can proceed. Background I'd like to setup a HIDS that has the ...
0
votes
1answer
39 views

Can Sagan block active acts once they've been detected?

I'm trying to determine if Sagan can do anything similar to fail2ban where detected attacks can be temporarily blacklisted, via a system's firewall (iptables). Does Sagan have any "countermeasures" or ...
0
votes
0answers
51 views

SSL Certificate and IDS\IPS

I'm currently drafting an infrastructure design to provide web (internet) access to a number of users to an internal web server in our perimeter DMZ, we have no direct internet access but we do have a ...
0
votes
1answer
289 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
2
votes
3answers
823 views

Is there any good reason to choose IDS over IPS?

As far as I know, IDS sniffs network traffic, and if intrusion is detected, reports it. And IPS sniffs network traffic, and if intrusion is detected, rejects it, and reports why it was blocked. Am ...
0
votes
1answer
60 views

Server Security Through Constant Check-ins [closed]

I've built a system and have put a ton of work into making sure is super secure. But I have a (potentially irrational) fear that if someone were able to break into my server, they could just change ...
0
votes
1answer
84 views

How to detect suspicious activity on a web and mailserver?

There is a OpenBSD (64bit; 5.5) server having nginx (HTTP/HTTPS) and SMTP (OpenSMTP). Question: What are the best practices to detect suspicious activity? Are there any scripts that shows ...
3
votes
1answer
80 views

Obfuscate IDS rules

Are there known techniques to obfuscate IDS rules, so they can't be easily used by attackers to reverse-engineer the vulnerability that they detect? Let me provide some context. Sometimes IDS ...
0
votes
3answers
112 views

Is there any hardware solution for IDS? [on hold]

Are there any products that let you see and set IDS [Intrusion detection system] on router or any another hardware that is connected to the router? All the ones I have found of them are Operating ...
1
vote
1answer
43 views

Scan interpreted code for long lines to detect code injection?

As http://security.stackexchange.com/a/11935/35886 states: the best protection against code injection is to prevent it but often you see posts on SO or here that goes like I found "long line of ...
1
vote
2answers
200 views

Intrusion Detected - OS Attack

I have recently gotten a prompt from my anti virus stating that there was an intrusion with an OS attack as describe in the link below: ...
0
votes
1answer
176 views

How can I test a DoS attack against snort?

I need to set up an scenario where an attacker DoS attacks port 80 of an server while snort and others users try to connect to port 80 at the same time. Something like this: 1000 connections to port ...
1
vote
2answers
124 views

the dangers of internet forums - what is FUD, what is not

I just visited a forum and a member knew what OS I was running without me saying anything (a not TOO common distro of linux). Now I'm not sure how he exactly he might have done it, or what information ...
2
votes
2answers
1k views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
0
votes
2answers
142 views

Securing a Windows PC

Currently I have an "Antivirus" and Anti Malware software installed. In addition I closed all remote assistance and unused port rules on my firewall. I'd really like to get a complete as possible ...
0
votes
1answer
37 views

Is it possible to detect IDS name and version

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?
1
vote
2answers
144 views

Web-based intrusion detection integrating visibility into web app and database

Consider the problem of hardening an existing, database-backed web application, to detect attacks and stop them where possible. It seems like one plausible approach might be to build an intrusion ...
3
votes
1answer
524 views

Open source solution to capture and decrypt SSH traffic (with private key)?

I am looking for a free open source solution that is able to capture and decrypt SSH traffic given the fact that I can provide the server's RSA private key (something like SSH CryptoAuditor). Please ...
0
votes
1answer
296 views

Are my Snort rules correct?

I am trying to do a Snort demo and I though it would be nice to detect a real threat. I picked the sasser worm and the jolt/teardrop dos attacks for the demo; no particular reason. Out of the three ...
1
vote
1answer
81 views

Help with successful Internal intrusions

I'm requesting some help with a particular breach of access that we've experienced in our environment. the attacker is an internal employee who has made a few notes about the environment that I ...
0
votes
0answers
155 views

Difference IDS/IPS layer 2 or 3

I understand that an IDS/IPS working on layer 2 has more insight into what is going on. But considering IDS/IPS evasions, why is a layer 2 device preferable as compared to a layer 3 device that is ...
2
votes
4answers
160 views

Intrusion detection architecture

I want to propose an architecture of intrusion detection on the schema shown below. Should I place one IDS in front of each server, or would one be sufficient for all the servers?
0
votes
1answer
123 views

What is a next generation IDS? [closed]

Intrusion detection has been there for many years. It monitors network traffic and/or system events like sys calls or other data and determines whether an event is intrusion or not. But I am curious ...
5
votes
1answer
271 views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
2
votes
1answer
509 views

Can a Tor exit node be reliably identified?

So with my knowledge of Tor, I know that exit nodes are where packets escape the Tor network and enter the "traceable" internet; ie. you can link an attack to an exit node but not the source of the ...
1
vote
2answers
225 views

How to detect Snort on the network?

Does anyone know how to fingerprint an IPS ? is there any tool available to do the job? I want to detect snort in my network . Would appreciate any kind of help.
0
votes
2answers
52 views

Attack Signatures books [closed]

I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on ...
0
votes
3answers
118 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
2
votes
2answers
87 views

server with eth0 promisc-mode vulnerable to attacks outside firewall?

If you use a passive network tap and a server with an Ethernet port in promiscuous mode to monitor all traffic between WAN port of your router and RJ45 port of your ISP cable modem. Is the IDS ...
2
votes
3answers
240 views

EICAR alternative for IDS/IPS

Is there a way to trigger alarms in an Intrusion Detection System with something similar to the EICAR test virus? Maybe some special packet that is harmless to the environement, but will trigger IDS? ...
6
votes
1answer
277 views

Isn't a HIDS, NIDS and WAF complementary?

Assume this scenario: Someone trying to hack a website. Simply put: www.site.com/example.php?=<script>alert(1)</script> A HIDS would see this attempt in Apache's access log, a NIDS would ...
2
votes
1answer
417 views

How to configure Suricata to not interfere with virtual machine

I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
2
votes
1answer
341 views

IPS/IDS and Firewall Solution(s) to a Small Office

I was tasked with implementing a network security solution for a small real estate agency. They are a typical old-school mom and pops shop, about 15 employees with basic file sharing, printing, and ...
2
votes
1answer
356 views

Locate rogue wireless access point using Kismet data

Is there any way how to use Kismet data to locate rogue wireless access points?