Intrusion Detection Systems
-1
votes
0answers
25 views
Looking for Dataset for Test IDS [closed]
I'm looking for some dataset for testing intrusion detection system,
I have found following datasets:
kdd 99,KDD2007,NSL-KDD,DARPA 1999,DARPA 2000,DEFCON 9,DEFCON-10,SSENet-2011,UNB ISCX
Do you know ...
1
vote
0answers
63 views
Security Onion:snorby alerts shows all local nerwork source IP(public and private)
I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
1
vote
1answer
173 views
Snort/IDS detect and alert on possible DoS/DDoS attack?
As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack.
Looking at the rulesets, which are primarily signature based rules, I can't see a ...
2
votes
2answers
141 views
Example of malware that spreads via USB? [closed]
I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware ...
4
votes
1answer
47 views
Security / logging on a Xen-based VPS instance?
Our company has a Xen-based instance on a VPS provider and we have some sensitive data stored on it. Is there a way for me to tell if/when employees of the hosting company have accessed my VPS (by ...
0
votes
1answer
37 views
How to specify a Snort rule connection duration?
Is it even possible to specify into a snort rule the duration of a connection?
For example: in this format Hour, Minute, Second
H, M, S = 0, 2, 1
If a connection that has the duration of 2 minutes ...
2
votes
1answer
84 views
How to add wildcards to snort rule ip address?
Is it possible to add wildcards or something that would function like them to a snort rule IP address?
For example:
If I'd like to detect source-ip of: 192.168.*.9
where the third octet can be ...
4
votes
1answer
76 views
Integrity check against package repository?
I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates.
From time to time I want to boot from a clean boot ...
1
vote
2answers
85 views
SYN scan, TCP packet question
during SYN scans, many small tcp packets are sent to multiple ports to determine which ports are open or not. But when you're streaming media, aren't you receiving many
One type of ID system, the ...
2
votes
1answer
129 views
Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?
I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not.
I will present my findings so far here, but it will be good if you guys can confirm ...
2
votes
1answer
229 views
Snort (IDS) Don't show Port Scans
I have install Snort & acidbase by this instruction and access it through this local address
127.0.0.1/acidbase/base_main.php
The problem is after scan it with nmap by this command
sudo ...
1
vote
1answer
140 views
snort ignores packets with matching src/dest IP address
This is my rule:
alert udp 192.168.1.1 4000 -> 192.168.1.1 7000 (msg:"This rule doesn't work"; sid:1234567;)
I am running snort against a precaptured packet file where there are UDP packets that ...
1
vote
2answers
102 views
Intrusion Prevention Systems: NIPS vs NBA
I was going through the wikipedia article on Intrusion Prevention Systems.
It states two of the four types of IPS as follows:
Network-based intrusion prevention system (NIPS): monitors the entire ...
3
votes
2answers
216 views
Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?
I understand that there are many applications such as Snort that do the job for network layer 3 IDS.
From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
-1
votes
1answer
72 views
Solutions to TCP FIN Host Sweep (Signature 3032)
The Intrusion Prevention System is giving me an attack with signature 3032, TCP FIN Host Sweep on one of the ip addresses. I need a solution or recommendation on how to avoid the TCP FIN Host Sweep.
3
votes
1answer
226 views
Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?
I'm trying to develop an IDS/IPS system project to include these elements:
A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1)
A Linux server (Running Kismet server + client)
...
1
vote
1answer
127 views
Snort, add TCP retransmission rule
Can somebody help me with adding rule for packet retransmission.
I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...
5
votes
2answers
205 views
How did Evernote detect the security breach?
http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/
Evernote's official message says little about technical details of the attack and how it was detected.
...
-3
votes
1answer
96 views
What's the best IDS for my machine? [closed]
I'm looking for free IDS that sniffs to traffic in real time.. Can anyone help me !
1
vote
1answer
80 views
how to handle error reply messages?
For security reasons, many organizations do not allow error reply messages to leave their internal Internets. How, specifically, could hackers use information in echo reply messages to learn about the ...
1
vote
1answer
86 views
How to capture packet using agent in JADE (Java Agent Development Framework)?
I need to design an IDS using Mobile agent. Can anyone suggest how packet capture software is efficient in JADE, how to match the captured packet for intrusion?
1
vote
2answers
147 views
What type of data does Snort log?
This is new to me, but what types of data does Snort log for Network Intrusion Detection?
I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
2
votes
1answer
146 views
Does Verizon Wireless LTE network have intrusion prevention capabilities?
Can someone tell me whether or not Verizon Wireless's LTE network has an IDS/IPS capability? I'm trying to compare the security of their CDMA/LTE network to others that are GSM.
EDIT for clarity: I ...
4
votes
1answer
93 views
Symbiote Counter-Attack Detection
I saw this video on YouTube about hacking Cisco phones (and other embedded systems) and I was overjoyed when the presenter not only hacked, but presented a security solution. Intrigued, I started ...
1
vote
1answer
148 views
How to find IPS events in sonicwall syslog
I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
1
vote
1answer
103 views
how to protect from Network scanner on android?
How can I block and detect network scanners on android platforms to stop scanning vlan of my hot spot.
My question is:
which scanners they use?
how can i detect such scanners?
Can i protect ...
2
votes
2answers
276 views
Where can I find worm traffic sample?
I have a program that has to detect scanning activity of worms.
I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
0
votes
0answers
90 views
Why there exists time-based features in KDD CUP'99? [closed]
In KDD CUP'99 there are time-based features calculated in last 2 seconds. But in the dataset there is only on record for a 8000 seconds long telnet connection. Shouldn't there exists a record for each ...
1
vote
2answers
443 views
What approaches are to detect DoS attack in IDS/Firewall?
First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
0
votes
1answer
135 views
Network anomaly detection or anomaly-based intrusion detection?
When implementing anomaly-based intrusion detection system, if I want to dismiss U2R and R2L attacks (to avoid deep packet inspection), and to consider only Probe and DoS attacks, what features should ...
-3
votes
2answers
127 views
anomaly detection: feature calculation problem [closed]
I have a question about how to calculate features selected in [ 1 ]. It assumes that the impact of DoS attack on features are nSrcs=nDsts=1, nPkts/sec>a, nSYN/Pkts>b, ... (Table 1 of [ 1 ])
...
0
votes
1answer
106 views
Why unsupervised anomaly-based intrustion detection training data should be normal or less noisy
I recently read a paper which stated that "Traditional anomaly detection algorithms require a set of purely normal data from which they train their model" [1]. But as in K-means, or other unsupervised ...
0
votes
1answer
133 views
How does an IDS system use PCAP to process malicious signatures?
I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?
0
votes
0answers
76 views
Intrusion Detection/Prevention, Autonegotiation and Network Taps [closed]
I'm setting up a hardware security appliance intrusion detection device (IDS) in monitor-mode (i.e., not inline), and I suspect I'm having some problems with Gigabit ethernet autonegotiation on a ...
0
votes
1answer
259 views
Why aren't anomaly-based intrusion detection schemes implemented in Snort?
I have read many papers on anomaly-based network intrusion detection. Am I correct that each of their techniques could be implemented as Snort preprocessor? If this is true, why there are no anomaly ...
0
votes
0answers
106 views
KDD CUP'99 flag feature's trouble with prevension [closed]
In KDD CUP'99 dataset, "flag" feature refers to "normal or error status of the connection",
which should changes as the TCP connection state changes. However in the training dataset it refers to the ...
3
votes
1answer
243 views
Anomaly Intrusion Detection relevant features
I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic.
I found 41 features from KDD CUP'99 project (the paper: WENKE ...
0
votes
3answers
435 views
Using an IPS as an alternative to mod_security
I am considering deploying mod_security as an addition to our web infrastructure. I am worried about the increased load however as these servers get a lot of hits. I am considering using IPS's such ...
2
votes
2answers
177 views
Enterprise IDS - Deployment & Uses
I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
0
votes
1answer
253 views
Interpreting Snort's stream5 alerts
I am using snort on a mirrored switchport. We have a lot of apple devices that are downloading mp3s directly from a directory index.
Snort is showing me a huge amount of, in particular, these two ...
2
votes
1answer
232 views
Open source or common implementations for reverse proxy web application security
I realize there is already a question similar to this one, but this is somewhat of a follow-up.
I understand that a reverse proxy server by itself is hardly useful as a web app security measure ...
2
votes
2answers
65 views
Information disclosure by identifiers
I'm doing a small research and I observed quite a lot of sites that reveal some private information in the ID-s that they assign. As an example I would like to point out e-commerce sites that issue ...
1
vote
1answer
252 views
Examples for (Web-)Security-Architectures
I just started to work on my thesis to finish my studies. However the field in which I write my thesis is pretty much new to me. I have the task to build a "Remote-Access Strategy/Architecture" to ...
-2
votes
6answers
2k views
How to check if someone is in my computer
Igen suspect that someone is may be controlling my computer using some remote desktop app. How I check if I am right or not?
My only clue is that my mouse sometimes start to move randomly (it is not ...
6
votes
1answer
494 views
How can an admin choose which Snort rules to enable?
The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection
attacks, port ...
12
votes
5answers
382 views
Neural networks & anomaly detection
Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
1
vote
1answer
107 views
IDS/WAF scenario for 2 web servers
I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
1
vote
1answer
242 views
Is a honeypot an IDS or an IPS or something else? Is it an offensive or a defensive technique? Is it still effective?
I'd like to know where a Honeypot falls into the scheme of security, and if it is still an effective tool?
2
votes
2answers
145 views
Is this enough for an NIDS
I am doing my senior project on network intrusion detection system (ethernet networks) and I am having a bit of trouble deciding if I have added enough features.
Currently the system detects the ...
2
votes
2answers
177 views
Security model for datacenters
I have several datacentres and now I want to plan security for it, so it's resilient to external attacks.
I need to make a security model which will cover my web servers, auth servers, log servers, ...
