Intrusion Detection System, a system for detecting and alerting based on behavior.

learn more… | top users | synonyms (2)

3
votes
1answer
2k views

Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?

I'm trying to develop an IDS/IPS system project to include these elements: A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1) A Linux server (Running Kismet server + client) ...
4
votes
1answer
2k views

Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?

I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not. I will present my findings so far here, but it will be good if you guys can confirm ...
1
vote
2answers
420 views

Intrusion Prevention Systems: NIPS vs NBA

I was going through the wikipedia article on Intrusion Prevention Systems. It states two of the four types of IPS as follows: Network-based intrusion prevention system (NIPS): monitors the entire ...
3
votes
2answers
631 views

Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?

I understand that there are many applications such as Snort that do the job for network layer 3 IDS. From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
-1
votes
1answer
1k views

Solutions to TCP FIN Host Sweep (Signature 3032)

The Intrusion Prevention System is giving me an attack with signature 3032, TCP FIN Host Sweep on one of the ip addresses. I need a solution or recommendation on how to avoid the TCP FIN Host Sweep.
1
vote
1answer
1k views

Snort, add TCP retransmission rule

Can somebody help me with adding rule for packet retransmission. I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...
5
votes
2answers
386 views

How did Evernote detect the security breach?

http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/ Evernote's official message says little about technical details of the attack and how it was detected. ...
1
vote
1answer
455 views

how to handle error reply messages?

For security reasons, many organizations do not allow error reply messages to leave their internal Internets. How, specifically, could hackers use information in echo reply messages to learn about the ...
1
vote
1answer
267 views

How to capture packet using agent in JADE (Java Agent Development Framework)?

I need to design an IDS using Mobile agent. Can anyone suggest how packet capture software is efficient in JADE, how to match the captured packet for intrusion?
2
votes
4answers
994 views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
1
vote
2answers
4k views

Snort false positive?

I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off: GPL SHELLCODE x86 inc ebx NOOP The payload is as ...
5
votes
1answer
137 views

Symbiote Counter-Attack Detection

I saw this video on YouTube about hacking Cisco phones (and other embedded systems) and I was overjoyed when the presenter not only hacked, but presented a security solution. Intrigued, I started ...
1
vote
1answer
2k views

How to find IPS events in sonicwall syslog

I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
1
vote
1answer
262 views

Working of WAF/IDS/IPS payload normalization schemes?

I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be base64Encode html EntityDecode url Encode Remove whitespaces I want to know how WAF/IDS/IPS ...
1
vote
1answer
161 views

how to protect from Network scanner on android?

How can I block and detect network scanners on android platforms to stop scanning vlan of my hot spot. My question is: which scanners they use? how can i detect such scanners? Can i protect ...
1
vote
2answers
945 views

Where can I find worm traffic sample?

I have a program that has to detect scanning activity of worms. I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
4
votes
1answer
502 views

Anomaly Intrusion Detection relevant features

I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic. I found 41 features from KDD CUP'99 project (the paper: WENKE ...
-3
votes
2answers
183 views

anomaly detection: feature calculation problem [closed]

I have a question about how to calculate features selected in [ 1 ]. It assumes that the impact of DoS attack on features are nSrcs=nDsts=1, nPkts/sec>a, nSYN/Pkts>b, ... (Table 1 of [ 1 ]) ...
0
votes
1answer
488 views

Network anomaly detection or anomaly-based intrusion detection?

When implementing anomaly-based intrusion detection system, if I want to dismiss U2R and R2L attacks (to avoid deep packet inspection), and to consider only Probe and DoS attacks, what features should ...
0
votes
1answer
289 views

Why unsupervised anomaly-based intrustion detection training data should be normal or less noisy

I recently read a paper which stated that "Traditional anomaly detection algorithms require a set of purely normal data from which they train their model" [1]. But as in K-means, or other unsupervised ...
0
votes
1answer
293 views

How does an IDS system use PCAP to process malicious signatures?

I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?
1
vote
1answer
1k views

Why aren't anomaly-based intrusion detection schemes implemented in Snort?

I have read many papers on anomaly-based network intrusion detection. Am I correct that each of their techniques could be implemented as Snort preprocessor? If this is true, why there are no anomaly ...
2
votes
3answers
2k views

Using an IPS as an alternative to mod_security

I am considering deploying mod_security as an addition to our web infrastructure. I am worried about the increased load however as these servers get a lot of hits. I am considering using IPS's such ...
7
votes
3answers
3k views

HIDS detection system and registry changes

I use OSSEC HIDS to monitor XP and Windows 7 Operating Systems. When OSSEC flags changes in the Windows registry, I have no idea where to go for to look for information and identify if the changes ...
2
votes
2answers
500 views

Enterprise IDS - Deployment & Uses

I am investigating deploying the Snort IDS for an enterprise environment. This environment consists of a NOC that manages several servers, mainly internal but some internet facing. There are several ...
15
votes
5answers
2k views

Neural networks & anomaly detection

Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
0
votes
1answer
816 views

Interpreting Snort's stream5 alerts

I am using snort on a mirrored switchport. We have a lot of apple devices that are downloading mp3s directly from a directory index. Snort is showing me a huge amount of, in particular, these two ...
2
votes
1answer
780 views

Open source or common implementations for reverse proxy web application security

I realize there is already a question similar to this one, but this is somewhat of a follow-up. I understand that a reverse proxy server by itself is hardly useful as a web app security measure ...
2
votes
2answers
75 views

Information disclosure by identifiers

I'm doing a small research and I observed quite a lot of sites that reveal some private information in the ID-s that they assign. As an example I would like to point out e-commerce sites that issue ...
1
vote
1answer
554 views

Examples for (Web-)Security-Architectures

I just started to work on my thesis to finish my studies. However the field in which I write my thesis is pretty much new to me. I have the task to build a "Remote-Access Strategy/Architecture" to ...
6
votes
1answer
2k views

How can an admin choose which Snort rules to enable?

The purpose is to configure Snort as an IDS to monitor network activity, and alert against the standard set of things an IDS should alert against--> buffer overflow attacks, injection attacks, port ...
2
votes
1answer
319 views

IDS/WAF scenario for 2 web servers

I'm running 2 web servers on 2 different physical hosts at home. They handle both HTTP and HTTPS traffic. I want to protect against web application attacks, but don't want to spend money for ...
1
vote
1answer
1k views

Is a honeypot an IDS or an IPS or something else? Is it an offensive or a defensive technique? Is it still effective?

I'd like to know where a Honeypot falls into the scheme of security, and if it is still an effective tool?
16
votes
7answers
3k views

Tripwire - Is it security Theater?

Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes. Let's say I have tripwire configured to run ...
3
votes
2answers
200 views

Is this enough for an NIDS

I am doing my senior project on network intrusion detection system (ethernet networks) and I am having a bit of trouble deciding if I have added enough features. Currently the system detects the ...
4
votes
2answers
909 views

Detect changes in /boot when using full disk encryption

When running a fully encrypted linux system using dm-crypt, the /boot partition has to be unencrypted to boot, as far as I know. I've setup a server that can be unlocked remotely by connecting to a ...
2
votes
1answer
2k views

Snort & Logging

I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me. I would like to use Snort to perform a trace, which, after it ...
6
votes
2answers
2k views

Snort Sensor Placement

I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
2
votes
4answers
577 views

Writing exploit code that bypasses IPS detection

Suppose that Network IPS/IDS can detect an exploit, however, the application server itself is still vulnerable to that exploit. If I modify the exploit code, are there IPS/IDS which will still ...
2
votes
2answers
922 views

How are signatures for IPS determined

For example , how do Snort's VRT team or some one who gives us the signatures, determine them at all ? I would be more interested to know , how are the traffic patterns analyzed against some known ...
1
vote
0answers
235 views

AD authentication with high amount of ICMP traffic [closed]

We have an IPS in place and it's constantly triggering ICMP / Ping flood signatures between workstations and AD server; or AD to workstation. I understand that ICMP is used for AD authentication. ...
4
votes
1answer
787 views

Outbound TFTP request to 255.255.255.255

Recently snort notified me that I have a user's computer on my network initiating an outbound TFTP request. The odd thing is the destination is 255.255.255.255 Anyone have a clue as to what this may ...
1
vote
1answer
239 views

SNMP trap by legitimate program?

Is there any way to tell if this SNMP trap is something created by a legitimate program? Update: Hex Dump 0000000: 30 82 00 ec 02 01 00 04 06 70 75 62 6c 69 63 a4 82 00 dd 06 82 00 09 2b 06 ...
3
votes
2answers
631 views

C&C domains used by Flame/Skywiper trojan

I'm trying to figure out if any of our clients have been infected by the recent trojan/worm Flame. I have access to our proxy logs, so I want to search for any requests made to the "known" C&C ...
4
votes
1answer
2k views

Bench marking Snort and other IDS/IPS

I am looking for facts and figures of research or surveys done which have bench-marked Snort with other IDS/IPS on various parameters like overall performance, accuracy, speed, documentation, ...
1
vote
1answer
180 views

WEB long basic authorization string/Buffer Over Flow

I have a external user getting a weird error in the middle of using my website. The user authenticates, post a search for information, and then with the address of the search results page they get a ...
0
votes
1answer
148 views

Tracing The Source Of IDS/IPS Alerts

This may be more of a routing question than a security one but I am asking for the reason of security. I monitor an IPS on a remote network and there have been high alerts triggered recently that ...
1
vote
2answers
1k views

What IDS Do you recommend? [closed]

I am running a Debian Squeeze VPS and need a good IDS. I have used snort before and it was quite good but i am wandering if there are any other good ones out there. Preferably compatible with ...
3
votes
3answers
280 views

Is there an IDS based on process patterns?

After reading what Metasploit is able to do my grey hairs got even more. From my understanding current attack methods are being done without tampering with any file in a filesystem - thus rendering ...
1
vote
3answers
250 views

will all instrusion dectection will become host-based? [closed]

Will all intrusion detection become host-based once all network packets have been encrypted?