Intrusion Detection Systems

learn more… | top users | synonyms (2)

1
vote
1answer
246 views

Can HIPS software practically be considered a form of MAC

Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system. Given that with the use ...
0
votes
1answer
354 views

Rules for log analysis in an IDS

I am working on an IDS which has brought into the view of log analysis basically. I have to detect an intruder if there are any user behaviour anomalies present in the logs. I am having problems ...
1
vote
1answer
488 views

types of intrusions on host [closed]

I am implementing an IDS and just want to know that what are the possibilities with which the intrusion can occur.I am just doing a literature survey over the atacks possible so I want to know that ...
11
votes
9answers
17k views

Tracking down a rogue access point

Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware ...
2
votes
3answers
347 views

Implementation of an IDS

I am starting my final year project and I have decided to make an Intrusion Detection System, but I am a little confused where to start. I have read some papers and those have been pointing out the ...
2
votes
2answers
735 views

How can an IPS\IDS detect SQLi \ XSS (or other application layer) attacks?

I've been thinking about how an IPS works, and as far as I know it inspects the packets on the TCP\IP layer. How can it detect attacks on higher levels without harming the user experience? How does ...
4
votes
1answer
944 views

Blacklist IP addresses based on number of 404s in Apache

I'm getting a lot of hackers spamming my domain with requests for files that just don't exist. This is eating up a lot of my allotted bandwidth and I'd like to blacklist these IP addresses. Is there ...
4
votes
1answer
474 views

Logging True/False Negatives on Snort

I'm using Snort in a lab environmnet with artificially generated traffic. I'm looking to build a confusion matrix from known generated attacks. True Positives and False Positives are easy to parse ...
12
votes
2answers
440 views

Detecting website attack attempts

I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to attacker, when he tries to break into my website. Is there any resource ...
6
votes
4answers
625 views

Is Stonesoft's “advanced evasion technique” a major problem?

A month ago, Stonesoft (an IDS constructor from Finland) has launched an alert about Advanced Evasion Techniques. With these techniques, they claim to be capable of launching attacks on a network ...
1
vote
1answer
195 views

OSSEC New Install: Scan and analyse full log?

When OSSEC is installed and started, it starts analyzing configured logs starting the date it was installed. Is there a way to have it scan and analyze the full logs?
1
vote
1answer
2k views

Power friendly home router, firewall, IDS/IPS setup?

For those that like to manage their own firewall and run IDS/IPS on their home networks, I'm curious - what are you using and is it power friendly? I used to have a shelf full systems doing various ...
0
votes
2answers
1k views

How do we protect our server from anonymous hacker? [duplicate]

Possible Duplicates: Hardening Linux Server How to best defend against Targeted Attacks? I read this news: Anonymous hacker group hits Apple, publishes data My question: How do we ...
9
votes
6answers
1k views

Applications of probability/statistics in IT security?

What are some areas of computer security that utilizes statistical modeling? I ask b/c I'm a studying statistics at school and have become interested after reading a few papers.. some of the areas ...
4
votes
2answers
488 views

Has anyone else seen commands embedded in an ICMP echo request?

My IPS recently detected a type 8 ICMP packet (echo request) with an unusual payload. The echo request command a fragment of a command that looked like part of a route add. Here's a PCAP of the ICMP ...
4
votes
1answer
302 views

Attacks against HIDS software running on the same machine

I am interested in the attacks that could be used to compromise or disable HIDS software such as Tripwire or Samhain. I understand that ideally checks should be run periodically and the database ...
5
votes
3answers
723 views

Best practice for creating an initial IPS policy

I see that most IPS available in the market comes with a basic pre-defined policy which administrators can base on when creating their initial IPS policy. However, these policy may be insufficient and ...
4
votes
3answers
374 views

Information gathering before deploying a Network IPS

I understand that most NIPS these days have either rules or signatures built in to them and perhaps gathering information prior to deployment may help in fine-tuning the rules / signature once the IPS ...
6
votes
3answers
433 views

How can an IPS be fingerprinted?

I'm not trying to solve a current technical problem but I came across this and have been wondering how it's done. Intrusion Prevention Systems are supposed to let all network traffic pass through and ...
11
votes
3answers
428 views

Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc?

This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter. I copied it here because I'm curious too. Rich posted these follow-up tweets: And by APT I mean real ...
16
votes
3answers
976 views

What techniques and tools do you use to relate security events?

You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...
3
votes
1answer
226 views

Checkpoint NGX IPS & NAT

how does CheckPoint R65/R70 handle IPS violations of outbound traffic from hosts that are NAT'ed? Is it necessary to include the NAT'ed IP in the exceptions list or is it sufficient to include the ...
6
votes
1answer
660 views

Intrusion Prevention Logs

I received an email from a client with IDS logs. I was wondering if the following log has any real indications of the server being compromised. If there are certain things I can do to diagnose the ...
5
votes
1answer
762 views

Tools to identify and report hacking attempts originating inside reputable organizations?

Re: Should I report hacking attempts? - Server Fault Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
9
votes
3answers
522 views

What FOSS software do you like to use to build intrusion detection stacks?

Start-ups and organizations with limited budgets that are security conscious are often encouraged to deploy intrusion detection stacks. Given that prevention will always fail, intrusion detection ...
1
vote
1answer
167 views

What is your experience with AlertLogic?

Do you have any insight, or experience (good or bad) regarding AlertLogic? In what areas can they improve, what areas are they lagging in?
6
votes
3answers
752 views

How do I identify an unknown port/protocol that my IDS picks up?

Googling a port and protocol leads to a terse description at best, and a linkfarm in the average case. Most protocols on assorted, unknown high ports contain little or no plaintext, and often if the ...
5
votes
2answers
142 views

Managing a team of IDS experts; how would you orgainze your team?

Suppose you are managing a team of Intrusion Detection Experts: ...what are the functional areas of the IDS knowledge space would you group your team into? ...how would you structure your team? ...