Intrusion Detection Systems

learn more… | top users | synonyms (2)

1
vote
0answers
34 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
0
votes
2answers
46 views

Security devices other than firewall and IDS [closed]

I was just studying about firewalls and IDS/IPS and had a doubt. Are these the only two major security devices that a company invests in? or are there other equipment and security controls?
3
votes
0answers
41 views

Retaining origin when using Snort with a loadbalancer? Or why it's a bad idea? [migrated]

Initially I deployed HAProxy so that it would be possible to notice bad traffic going into my web server (rather than it being obscured by TLS), but now I noticed the rather obvious problem that once ...
6
votes
3answers
597 views

Can the IPS technology in a UTM prevent a DDoS attack?

Does a Unified Threat Management appliance (UTM) with Intrusion Prevention (IPS) enabled have the ability to prevent a DDoS attack? I have read some articles and none of them have a perfect ...
0
votes
1answer
32 views

Snort: Arpspoof preprocessor events not showing up in BASE UI

I have followed this guide to install Snort, using Barnyard2, BASE, IIS, and MySql. My Snort is up & running and loads of events are being logged. After weeding out some false positives, I wanted ...
2
votes
0answers
49 views

Snort alerts analysis (web interface) [closed]

I have a question about Snort (or maybe any other IDS/IPS, any working solutions would be ok). The goal is to set up some web interface providing a way to view the whole TCP stream packets of each ...
0
votes
1answer
33 views

Call For papers format help [closed]

I’m intending to submit a personal project for a “call for papers” for an upcoming Con. I have a really interesting topic that I wanted to submit for the talk. I was hoping to gain some feed back on ...
-1
votes
1answer
69 views

Can Snort be configured as HIDS?

I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS. I want to know is there any way I can configure Snort as an HIDS? If I am ...
-1
votes
2answers
63 views

Detecting malicious domains/URLs [closed]

Do state of the art commercial URL threat intelligence feeds ( for example, one's by Symantec, Intel-security etc) miss malicious domains? (i.e. domains serving malware,exploit code & phishing ...
8
votes
4answers
633 views

Evading IDS in exploit development

In the context of buffer overflow exploit development, I was asked: Discuss how your exploit may be modified to evade an Intrusion Detection System. I'm not asking for my homework to be done, but ...
1
vote
3answers
69 views

IDS over HTTPS connection

I am designing an anomaly-based intrusion detection system in java. It basically consists of a sniffer that identifies HTTP header fields and then analyze them according to a previous configured XML ...
3
votes
1answer
68 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
0
votes
1answer
157 views

Is it possible to detect a keylogger, when placed? [duplicate]

Can you detect a keylogger when it is placed? Would it be possible to do that via a keyboard removed event, expecting the keyboard is not removed regularly? So that you for example get a pop-up/alert ...
2
votes
0answers
64 views

Decrypt TLS from an IDS

So I am trying to figure out what the packet payload is off of a possible TLS HeartBleed alert from my IDS. I have read that Wireshark is able to do it with some certain keys, but isn't that in real ...
0
votes
0answers
87 views

problem with my snort rule

I have written this rule but when I try to reload Snort it is failing. I have commented out the rule and reloaded snort; it is working so I know it's the rule. alert tcp any any -> any 5466 ...
0
votes
1answer
56 views

Customize an Intrusion Detection System for serial communication

Most of the Intrusion detection Systems I know of is for IP Communication. But, lets assume that I have serial communication, i.e. CAN or RS485. On this serial Communication there are customized ...
-6
votes
1answer
56 views

network IDS capabilities for attack detection [closed]

Is a Network Intrusion Detection System (NIDS) (pattern matching, protocol analysis or behavior analysis) able to detect buffer overflow in the network traffic?
8
votes
1answer
171 views

Setting up own enterprise SOC

the other day I was talking with a service provider (MSSP) who have experience with operating SOC (security operations centre) 24x7. Their price was rather steep (in the millions range). I don't ...
1
vote
1answer
46 views

Using snort with cloudflare? [closed]

How might Snort or another IDS system work with Cloudflare? Essentially, the originating IP would be CloudFlare's, therefore a proactive IPS might be difficult to install. I understand that ...
1
vote
3answers
141 views

Why Bash Shellshock vulnerability cannot be detected at webservers in advance?

There are lots of posts regarding the shellshock vulnerability. I can understand the vulnerability in detail. However, I'm curious about why any Intrusion detection system or host-based tools (e.g., ...
1
vote
1answer
75 views

What could this set of IDS alerts be (DDNS deaftone.com darktech.org chatnook.com, …)?

Below is a screeny of my Squert GUI showing the Snort events. Notice they all happen at the same exact time. I cannot figure out what the source of it could be. Any ideas? Edit: It looks like the ...
2
votes
1answer
338 views

Snort IDS for Amazon deployment

Is Snort a good choice for monitoring network and web application traffic on Amazon EC2? If not, why and what IDS would you suggest? Is Snort a good choice to monitor for XSS, Sql Injection, attempt ...
0
votes
0answers
40 views

Possible to run snort without modifiers?

Is there anyway (e.g some command line argument) with which we can tell snort to run and perform detection but without caring for the rule modifiers if there are any ? e.g alert tcp any any -> ...
-1
votes
1answer
85 views

Recommendations for installing OSSIM

I'm an apprentice in web security and I was assigned with the task of researching about OSSIM. Bear with my infinite ignorance as I take my questions to the stack exchange gurus. What I know so far: ...
1
vote
2answers
146 views

List of security products for my network [closed]

We are building and environment where mostly open source and trial versions would be used first before we purchase any product. I need your recommendation on the tools required to build a network that ...
1
vote
0answers
147 views

OSSEC not detecting deleted files?

I have configured 3 VMs: ossec server and two agents in CentOS 6 and Windows 2k8 R2. I have completed the setup and FIM and Log Management works smoothly. It also reports the new files. However, it ...
-1
votes
2answers
662 views

What are the difference between IPS and WAF in terms of DDoS?

I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?
2
votes
1answer
44 views

I want to filter Snort rules by date written [closed]

I would like the ability to look at Snort rules that were written in specific date ranges only given a collection of .rules files from either Sourcefire or Emerging Threats. Is this possible?
1
vote
2answers
120 views

IDS across seperate AWS accounts

I have 2 separate AWS accounts and I would like to a Vuln scanner/IDS on one to scan another. One environment is a regular AWS account and the other is in AWS Gov Cloud. Due to limitations within ...
1
vote
1answer
272 views

How to detect/mitigate UDP port scan using OpenBSD and pf

One of our OpenBSD firewalls experienced a flood of UDP traffic from a compromised host within our internal network. The traffic was exchanged between the compromised internal host and a single ...
0
votes
3answers
519 views

Why do we need IDS/IPS if a firewall is present?

Why do we need IDS/IPS if a firewall is present?
0
votes
1answer
70 views

Why does IBM's Intrusion Detection System Show Local IPs instead of Public IPs for the Source of an Attack?

Security Intern here given the assignment to find the IP address of an attacker using IBM's IDS. The event or attack in question is entitled X509_Weak_Signature_Algorithm, and from what I ...
0
votes
1answer
143 views

Snort Rule Comparison

As far as I read, Emerging threats and VRT Snort rules are available freely, and also Pro (fee based). Is there any comparision, or anything to suggest choose one over another? What are the benefits ...
2
votes
1answer
134 views

Anomaly intrusion detection

Anyone know which opensource network IDSs are using anomaly techniques? My project is to compare them, so if you could give me some hints, that would be much appreciated. Currently, I am looking at ...
0
votes
1answer
97 views

HIDS that can detect attacks, take immediate action locally, and then report to a central service for re-broadcasting to other systems?

I've been researching this for a bit now and cannot find what I want. So I'm to the point where I'm weighing my options as to how I can proceed. Background I'd like to setup a HIDS that has the ...
0
votes
1answer
65 views

Can Sagan block active acts once they've been detected?

I'm trying to determine if Sagan can do anything similar to fail2ban where detected attacks can be temporarily blacklisted, via a system's firewall (iptables). Does Sagan have any "countermeasures" or ...
0
votes
0answers
87 views

SSL Certificate and IDS\IPS

I'm currently drafting an infrastructure design to provide web (internet) access to a number of users to an internal web server in our perimeter DMZ, we have no direct internet access but we do have a ...
0
votes
1answer
381 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
2
votes
3answers
860 views

Is there any good reason to choose IDS over IPS?

As far as I know, IDS sniffs network traffic, and if intrusion is detected, reports it. And IPS sniffs network traffic, and if intrusion is detected, rejects it, and reports why it was blocked. Am ...
0
votes
1answer
68 views

Server Security Through Constant Check-ins [closed]

I've built a system and have put a ton of work into making sure is super secure. But I have a (potentially irrational) fear that if someone were able to break into my server, they could just change ...
0
votes
1answer
119 views

How to detect suspicious activity on a web and mailserver?

There is a OpenBSD (64bit; 5.5) server having nginx (HTTP/HTTPS) and SMTP (OpenSMTP). Question: What are the best practices to detect suspicious activity? Are there any scripts that shows ...
3
votes
1answer
91 views

Obfuscate IDS rules

Are there known techniques to obfuscate IDS rules, so they can't be easily used by attackers to reverse-engineer the vulnerability that they detect? Let me provide some context. Sometimes IDS ...
0
votes
3answers
191 views

Is there any hardware solution for IDS? [closed]

Are there any products that let you see and set IDS [Intrusion detection system] on router or any another hardware that is connected to the router? All the ones I have found of them are Operating ...
1
vote
1answer
49 views

Scan interpreted code for long lines to detect code injection?

As http://security.stackexchange.com/a/11935/35886 states: the best protection against code injection is to prevent it but often you see posts on SO or here that goes like I found "long line of ...
1
vote
2answers
223 views

Intrusion Detected - OS Attack

I have recently gotten a prompt from my anti virus stating that there was an intrusion with an OS attack as describe in the link below: ...
0
votes
1answer
212 views

How can I test a DoS attack against snort?

I need to set up an scenario where an attacker DoS attacks port 80 of an server while snort and others users try to connect to port 80 at the same time. Something like this: 1000 connections to port ...
1
vote
2answers
145 views

the dangers of internet forums - what is FUD, what is not

I just visited a forum and a member knew what OS I was running without me saying anything (a not TOO common distro of linux). Now I'm not sure how he exactly he might have done it, or what information ...
2
votes
2answers
2k views

How to block network scans with pfsense?

I am using pfsense as firewall, and I would like to know how I can stop network scans from enumerating open services and ports. Thanks
0
votes
2answers
166 views

Securing a Windows PC

Currently I have an "Antivirus" and Anti Malware software installed. In addition I closed all remote assistance and unused port rules on my firewall. I'd really like to get a complete as possible ...
0
votes
1answer
47 views

Is it possible to detect IDS name and version

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?