Intrusion Detection System, a system for detecting and alerting based on behavior.

learn more… | top users | synonyms (2)

1
vote
0answers
393 views

OSSEC not detecting deleted files?

I have configured 3 VMs: ossec server and two agents in CentOS 6 and Windows 2k8 R2. I have completed the setup and FIM and Log Management works smoothly. It also reports the new files. However, it ...
1
vote
0answers
777 views

Difference IDS/IPS layer 2 or 3

I understand that an IDS/IPS working on layer 2 has more insight into what is going on. But considering IDS/IPS evasions, why is a layer 2 device preferable as compared to a layer 3 device that is ...
1
vote
1answer
915 views

How to configure Suricata to not interfere with virtual machine [closed]

I'm currently planning on setting up Suricata as a firewall on my laptop. I'm wondering however if it's possible to set Suricata to not interfere with traffic to and from specific virtual machines ...
1
vote
0answers
632 views

Snort not showing dropped/blocked packets

This question is about SNORT- I m basically trying to detect PING FLOOD attack. I have included the rule**(drop icmp any any -> any any (itype:8; threshold, track by_src, count 20, ...
1
vote
0answers
115 views

Alert correlation benchmark [closed]

I'm looking for some alert correlation tool to reduce number of alerts about 50%. It should support IDMEF. I googled for alert correlation tools but just found ACARM-ng, TIAA and MACE and all of them ...
1
vote
0answers
146 views

State transition Analysis Technique

As far as I have read and understood STAT is a concept used to design a platform independent IDS. My doubt is whether there exists any compiler/interpreter for STAT Language as I am planning to do a ...
1
vote
1answer
302 views

Working of WAF/IDS/IPS payload normalization schemes?

I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be base64Encode html EntityDecode url Encode Remove whitespaces I want to know how WAF/IDS/IPS ...
1
vote
2answers
115 views

How eavesdropping attack takes place in network

I am learning some concepts of network security and I have the following question: One case of eavesdropping attack is that an adversary somehow places himself inside a network to order to capture ...
1
vote
2answers
260 views

List of security products for my network [closed]

We are building and environment where mostly open source and trial versions would be used first before we purchase any product. I need your recommendation on the tools required to build a network that ...
0
votes
3answers
2k views

Why do we need IDS/IPS if a firewall is present?

Why do we need IDS/IPS if a firewall is present?
0
votes
1answer
278 views

Intrusion Detection System and Network Intrusion Detection Systems [duplicate]

IDS (Intrusion Detection System), NIDS (Network Intrusion Detection System) What's the difference between IDS and NIDS? Can I use more than one IDS and NIDS at the same time? Or both IDS and NIDS ...
0
votes
1answer
338 views

What is a next generation IDS? [closed]

Intrusion detection has been there for many years. It monitors network traffic and/or system events like sys calls or other data and determines whether an event is intrusion or not. But I am curious ...
0
votes
2answers
2k views

How do we protect our server from anonymous hacker? [duplicate]

Possible Duplicates: Hardening Linux Server How to best defend against Targeted Attacks? I read this news: Anonymous hacker group hits Apple, publishes data My question: How do we ...
0
votes
2answers
213 views

the dangers of internet forums - what is FUD, what is not

I just visited a forum and a member knew what OS I was running without me saying anything (a not TOO common distro of linux). Now I'm not sure how he exactly he might have done it, or what information ...
0
votes
1answer
162 views

Tracing The Source Of IDS/IPS Alerts

This may be more of a routing question than a security one but I am asking for the reason of security. I monitor an IPS on a remote network and there have been high alerts triggered recently that ...
0
votes
2answers
100 views

Distinction of DPI and IDS

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in ...
0
votes
1answer
46 views

Nil events in IPS reports today [closed]

The IPS reports have one or two events minimum every day so far. But today there were no events, both in DC1 and DC2 reports. I am wondering if this possible? How come on a particular day nobody ...
0
votes
1answer
35 views

Call For papers format help [closed]

I’m intending to submit a personal project for a “call for papers” for an upcoming Con. I have a really interesting topic that I wanted to submit for the talk. I was hoping to gain some feed back on ...
0
votes
1answer
565 views

High-Risk Intrusion Detected

I have an endpoint protection from Symantec. Recently, I have been receiving many Symantec Cloud Alert emails. wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php They ...
0
votes
3answers
289 views

IDS in combination with vulnerability scanner

I'm planning to set up a server environment with high security requirements on which i want to install an intrusion detection system (snort). Additionally, I think of running a vulnerability scanner (...
0
votes
2answers
616 views

Questions on IDS, IPS, VLANs and VPN [closed]

I have a network that has a single point of entry the WAN. The WAN exposes about 10 static IP's that resolve internally to servers that are in the same subnet. Meaning that if you RDP over 3389 to ...
0
votes
1answer
95 views

Understand how dionaea honeypot emulated services work

I'm trying to understand Dionaea honeypot and the information flow. I understand that it emulates some services, like SMB, ftp, tftp, try to responde with these, then gets the shellcode and ...
0
votes
2answers
489 views

How to make sense of, and act on, Snort Rules?

I am a relatively new Snort user with years of sys admin experience. I feel that I must be missing something, because I find Snort rules to be completely undocumented and incomprehensible. Because of ...
0
votes
2answers
124 views

Detecting malicious domains/URLs [closed]

Do state of the art commercial URL threat intelligence feeds ( for example, one's by Symantec, Intel-security etc) miss malicious domains? (i.e. domains serving malware,exploit code & phishing ...
0
votes
1answer
70 views

Server Security Through Constant Check-ins [closed]

I've built a system and have put a ton of work into making sure is super secure. But I have a (potentially irrational) fear that if someone were able to break into my server, they could just change ...
0
votes
1answer
76 views

Is it possible to detect IDS name and version

the title said it. Is it possible to detect IDS name and version. If server use Snort as IDS, would I be able to detect it from external PC? And if it's possible how?
0
votes
1answer
320 views

Cryptic threat names

I have logs from a security appliance from Damballa which has cryptic names for threats observed in a network which I am trying to make sense of. Some examples of these threats are "RedTreeBruisers" , ...
0
votes
1answer
386 views

IDS false positive rates

Are there any industry accepted standards for the false positive rates for a Network IDS based on Snort? Is there a way to check the false positive rates in a deployed IDS? (ideally without looking at ...
0
votes
1answer
90 views

How to specify a Snort rule connection duration?

Is it even possible to specify into a snort rule the duration of a connection? For example: in this format Hour, Minute, Second H, M, S = 0, 2, 1 If a connection that has the duration of 2 minutes ...
0
votes
1answer
600 views

Network anomaly detection or anomaly-based intrusion detection?

When implementing anomaly-based intrusion detection system, if I want to dismiss U2R and R2L attacks (to avoid deep packet inspection), and to consider only Probe and DoS attacks, what features should ...
0
votes
1answer
382 views

Why unsupervised anomaly-based intrustion detection training data should be normal or less noisy

I recently read a paper which stated that "Traditional anomaly detection algorithms require a set of purely normal data from which they train their model" [1]. But as in K-means, or other unsupervised ...
0
votes
3answers
91 views

How does a hack leave no trace in server logs when there is a WORM IDS?

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)? If an IDS is monitoring the ...
0
votes
1answer
77 views

Do I need ossec for my personal home computer? [closed]

Do I really need a HIDS like ossec, or will using good passwords, using a firewall, an antivirus/antimalware program, and a rootkit scanner do the job well enough?
0
votes
1answer
91 views

fwsnort - How safe compared with Snort/Suricata?

How safe is 'fwsnort' compared to a real Snort / Suricata instance? What's the percentage of VRT / ET Rules, that fwsnort can actually use? I read somewhere from an older article its only ~ 60% - is ...
0
votes
1answer
68 views

Windows SQL Server Intrusion Detection [closed]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
0
votes
1answer
220 views

Snort - Rule: Alert all php requests

I am trying to understand writing rules for snort. Further goal is detection of sql injections like here. I've read the documentation of snort rules and created this rule: alert tcp any any -> ...
0
votes
2answers
2k views

NIDS/NIPS vs HIDS/HIPS

Can we interchangeably deploy a HIDS or HIPS instead of a NIDS/NIPS, what would be the risks, for example you have Symanetec EPS modules with HIPS policies enabled how are they different from a ...
0
votes
1answer
106 views

Why does IBM's Intrusion Detection System Show Local IPs instead of Public IPs for the Source of an Attack?

Security Intern here given the assignment to find the IP address of an attacker using IBM's IDS. The event or attack in question is entitled X509_Weak_Signature_Algorithm, and from what I understand,...
0
votes
1answer
517 views

Snort Rule Comparison

As far as I read, Emerging threats and VRT Snort rules are available freely, and also Pro (fee based). Is there any comparision, or anything to suggest choose one over another? What are the benefits ...
0
votes
1answer
182 views

HIDS that can detect attacks, take immediate action locally, and then report to a central service for re-broadcasting to other systems?

I've been researching this for a bit now and cannot find what I want. So I'm to the point where I'm weighing my options as to how I can proceed. Background I'd like to setup a HIDS that has the ...
0
votes
1answer
92 views

Can Sagan block active acts once they've been detected?

I'm trying to determine if Sagan can do anything similar to fail2ban where detected attacks can be temporarily blacklisted, via a system's firewall (iptables). Does Sagan have any "countermeasures" or ...
0
votes
1answer
315 views

How to detect suspicious activity on a web and mailserver?

There is a OpenBSD (64bit; 5.5) server having nginx (HTTP/HTTPS) and SMTP (OpenSMTP). Question: What are the best practices to detect suspicious activity? Are there any scripts that shows ...
0
votes
1answer
442 views

How can I test a DoS attack against snort?

I need to set up an scenario where an attacker DoS attacks port 80 of an server while snort and others users try to connect to port 80 at the same time. Something like this: 1000 connections to port ...
0
votes
2answers
100 views

Attack Signatures books [closed]

I have an assignment to do for school which involves attack signatures (I have to do a service-specific IDS). Basically what I have to do is to generate signatures for some attacks with Metasploit on ...
0
votes
1answer
53 views

Industry standards for threat names

One of the security appliances we own reports a so-called "Industry Name" for the threats it detects on the network. I wanted to know if there is really such a standard and where I can find ...
0
votes
1answer
137 views

Intrusion Detection and Prevention technologies [closed]

I'm supposed to do a research paper on a recent technology and I thought of doing it on a technology in information security. I found interest on Intrusion detection and prevention systems (IDPS) but ...
0
votes
1answer
357 views

How does an IDS system use PCAP to process malicious signatures?

I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?
0
votes
1answer
1k views

Interpreting Snort's stream5 alerts

I am using snort on a mirrored switchport. We have a lot of apple devices that are downloading mp3s directly from a directory index. Snort is showing me a huge amount of, in particular, these two ...
0
votes
1answer
135 views

Is there a Snort rule that equates to “something suspicious flagged from a client side application?”

The reasoning is what if an enterprise monitors snort alerts more-so than say syslog. Is there a specific pre-defined alert for 'client side app says something fishy is going on'?
0
votes
1answer
522 views

Rules for log analysis in an IDS

I am working on an IDS which has brought into the view of log analysis basically. I have to detect an intruder if there are any user behaviour anomalies present in the logs. I am having problems ...