Intrusion Detection System, a system for detecting and alerting based on behavior.

learn more… | top users | synonyms (2)

1
vote
0answers
144 views

State transition Analysis Technique

As far as I have read and understood STAT is a concept used to design a platform independent IDS. My doubt is whether there exists any compiler/interpreter for STAT Language as I am planning to do a ...
1
vote
0answers
250 views

AD authentication with high amount of ICMP traffic [closed]

We have an IPS in place and it's constantly triggering ICMP / Ping flood signatures between workstations and AD server; or AD to workstation. I understand that ICMP is used for AD authentication. ...
1
vote
1answer
292 views

Working of WAF/IDS/IPS payload normalization schemes?

I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be base64Encode html EntityDecode url Encode Remove whitespaces I want to know how WAF/IDS/IPS ...
1
vote
2answers
100 views

How eavesdropping attack takes place in network

I am learning some concepts of network security and I have the following question: One case of eavesdropping attack is that an adversary somehow places himself inside a network to order to capture ...
1
vote
2answers
248 views

List of security products for my network [closed]

We are building and environment where mostly open source and trial versions would be used first before we purchase any product. I need your recommendation on the tools required to build a network that ...
0
votes
3answers
2k views

Why do we need IDS/IPS if a firewall is present?

Why do we need IDS/IPS if a firewall is present?
0
votes
1answer
319 views

What is a next generation IDS? [closed]

Intrusion detection has been there for many years. It monitors network traffic and/or system events like sys calls or other data and determines whether an event is intrusion or not. But I am curious ...
0
votes
2answers
2k views

How do we protect our server from anonymous hacker? [duplicate]

Possible Duplicates: Hardening Linux Server How to best defend against Targeted Attacks? I read this news: Anonymous hacker group hits Apple, publishes data My question: How do we ...
0
votes
2answers
205 views

the dangers of internet forums - what is FUD, what is not

I just visited a forum and a member knew what OS I was running without me saying anything (a not TOO common distro of linux). Now I'm not sure how he exactly he might have done it, or what information ...
0
votes
1answer
158 views

Tracing The Source Of IDS/IPS Alerts

This may be more of a routing question than a security one but I am asking for the reason of security. I monitor an IPS on a remote network and there have been high alerts triggered recently that ...
0
votes
2answers
68 views

Distinction of DPI and IDS

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in ...
0
votes
1answer
45 views

Nil events in IPS reports today [closed]

The IPS reports have one or two events minimum every day so far. But today there were no events, both in DC1 and DC2 reports. I am wondering if this possible? How come on a particular day nobody ...
0
votes
1answer
234 views

Intrusion Detection System and Network Intrusion Detection Systems [duplicate]

IDS (Intrusion Detection System), NIDS (Network Intrusion Detection System) What's the difference between IDS and NIDS? Can i use more than one IDS and NIDS at the same time? Or both IDS and NIDS ...
0
votes
1answer
35 views

Call For papers format help [closed]

I’m intending to submit a personal project for a “call for papers” for an upcoming Con. I have a really interesting topic that I wanted to submit for the talk. I was hoping to gain some feed back on ...
0
votes
1answer
556 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
0
votes
3answers
263 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner ...
0
votes
2answers
587 views

Questions on IDS, IPS, VLANs and VPN [closed]

I have a network that has a single point of entry the WAN. The WAN exposes about 10 static IP's that resolve internally to servers that are in the same subnet. Meaning that if you RDP over 3389 to ...
0
votes
2answers
413 views

How to make sense of, and act on, Snort Rules?

I am a relatively new Snort user with years of sys admin experience. I feel that I must be missing something, because I find Snort rules to be completely undocumented and incomprehensible. Because of ...
0
votes
2answers
119 views

Detecting malicious domains/URLs [closed]

Do state of the art commercial URL threat intelligence feeds ( for example, one's by Symantec, Intel-security etc) miss malicious domains? (i.e. domains serving malware,exploit code & phishing ...
0
votes
1answer
70 views

Server Security Through Constant Check-ins [closed]

I've built a system and have put a ton of work into making sure is super secure. But I have a (potentially irrational) fear that if someone were able to break into my server, they could just change ...
0
votes
1answer
71 views

Is it possible to detect IDS name and version

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?
0
votes
1answer
315 views

Cryptic threat names

I have logs from a security appliance from Damballa which has cryptic names for threats observed in a network which I am trying to make sense of. Some examples of these threats are "RedTreeBruisers" , ...
0
votes
1answer
366 views

IDS false positive rates

Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at ...
0
votes
1answer
87 views

How to specify a Snort rule connection duration?

Is it even possible to specify into a snort rule the duration of a connection? For example: in this format Hour, Minute, Second H, M, S = 0, 2, 1 If a connection that has the duration of 2 minutes ...
0
votes
1answer
584 views

Network anomaly detection or anomaly-based intrusion detection?

When implementing anomaly-based intrusion detection system, if I want to dismiss U2R and R2L attacks (to avoid deep packet inspection), and to consider only Probe and DoS attacks, what features should ...
0
votes
1answer
364 views

Why unsupervised anomaly-based intrustion detection training data should be normal or less noisy

I recently read a paper which stated that "Traditional anomaly detection algorithms require a set of purely normal data from which they train their model" [1]. But as in K-means, or other unsupervised ...
0
votes
3answers
66 views

How does a hack leave no trace in server logs when there is a WORM IDS?

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)? If an IDS is monitoring the ...
0
votes
1answer
80 views

Understand how dionaea honeypot emulated services work

I'm trying to understand Dionaea honeypot and the information flow. I understand that it emulates some services, like SMB, ftp, tftp, try to responde with these, then gets the shellcode and ...
0
votes
1answer
62 views

Do I need ossec for my personal home computer? [closed]

Do I really need a HIDS like ossec, or will using good passwords, using a firewall, an antivirus/antimalware program, and a rootkit scanner do the job well enough?
0
votes
1answer
152 views

Suricata rule to block particular website question

I am writing rule for suricata which is going to block the possibility to enter one of the website for example xyz.com (instead of facebook, because with facebook there are some problems). I am doing ...
0
votes
1answer
71 views

fwsnort - How safe compared with Snort/Suricata

How safe is 'fwsnort' compared to a real Snort / Suricata instance? Whats the percentage of VRT / ET Rules, that fwsnort can actually use? I read somewhere from an older article its only ~ 60% - is ...
0
votes
1answer
60 views

Windows SQL Server Intrusion Detection [closed]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
0
votes
1answer
205 views

Snort - Rule: Alert all php requests

I am trying to understand writing rules for snort. Further goal is detection of sql injections like here. I've read the documentation of snort rules and created this rule: alert tcp any any -> ...
0
votes
2answers
1k views

NIDS/NIPS vs HIDS/HIPS

Can we interchangeably deploy a HIDS or HIPS instead of a NIDS/NIPS, what would be the risks, for example you have Symanetec EPS modules with HIPS policies enabled how are they different from a ...
0
votes
1answer
105 views

Why does IBM's Intrusion Detection System Show Local IPs instead of Public IPs for the Source of an Attack?

Security Intern here given the assignment to find the IP address of an attacker using IBM's IDS. The event or attack in question is entitled X509_Weak_Signature_Algorithm, and from what I ...
0
votes
1answer
439 views

Snort Rule Comparison

As far as I read, Emerging threats and VRT Snort rules are available freely, and also Pro (fee based). Is there any comparision, or anything to suggest choose one over another? What are the benefits ...
0
votes
1answer
161 views

HIDS that can detect attacks, take immediate action locally, and then report to a central service for re-broadcasting to other systems?

I've been researching this for a bit now and cannot find what I want. So I'm to the point where I'm weighing my options as to how I can proceed. Background I'd like to setup a HIDS that has the ...
0
votes
1answer
89 views

Can Sagan block active acts once they've been detected?

I'm trying to determine if Sagan can do anything similar to fail2ban where detected attacks can be temporarily blacklisted, via a system's firewall (iptables). Does Sagan have any "countermeasures" or ...
0
votes
1answer
285 views

How to detect suspicious activity on a web and mailserver?

There is a OpenBSD (64bit; 5.5) server having nginx (HTTP/HTTPS) and SMTP (OpenSMTP). Question: What are the best practices to detect suspicious activity? Are there any scripts that shows ...
0
votes
1answer
419 views

How can I test a DoS attack against snort?

I need to set up an scenario where an attacker DoS attacks port 80 of an server while snort and others users try to connect to port 80 at the same time. Something like this: 1000 connections to port ...
0
votes
2answers
91 views

Attack Signatures books [closed]

I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on ...
0
votes
1answer
53 views

Industry standards for threat names

One of the security appliances we own reports a so-called "Industry Name" for the threats it detects on the network. I wanted to know if there is really such a standard and where I can find ...
0
votes
1answer
132 views

Intrusion Detection and Prevention technologies [closed]

I'm supposed to do a research paper on a recent technology and I thought of doing it on a technology in information security. I found interest on Intrusion detection and prevention systems (IDPS) but ...
0
votes
1answer
340 views

How does an IDS system use PCAP to process malicious signatures?

I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?
0
votes
1answer
968 views

Interpreting Snort's stream5 alerts

I am using snort on a mirrored switchport. We have a lot of apple devices that are downloading mp3s directly from a directory index. Snort is showing me a huge amount of, in particular, these two ...
0
votes
1answer
131 views

Is there a Snort rule that equates to “something suspicious flagged from a client side application?”

The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
0
votes
1answer
516 views

Rules for log analysis in an IDS

I am working on an IDS which has brought into the view of log analysis basically. I have to detect an intruder if there are any user behaviour anomalies present in the logs. I am having problems ...
0
votes
0answers
6 views

What should be the user set to , if i want to send the suricata log files to remote nxlog? [migrated]

I am stuck at a point , basically i have suricata installed on the machine & the same machine has rsyslog. I am wondering by which user:group should we run suricata such that it is able to produce ...
0
votes
1answer
94 views

(spp_sdf) SDF Combination Alerts in Snort

I'm testing Snort in IDS mode and have been receiving a few (spp_sdf) SDF Combination Alerts as below. Seems like it happens when I visit certain but not all https sites. Tried to google this alert ...
0
votes
1answer
62 views

snort rule to detect relay attempt not working

I am trying to detect a relay attempt on smtp server, but nothing gets logs when I test it out. The snort rule to detect a relay attempt which I tried using is: alert tcp $SMTP_SERVERS 25 -> ...