Intrusion Detection System, a system for detecting and alerting based on behavior.

learn more… | top users | synonyms (2)

3
votes
2answers
225 views

Is this enough for an NIDS

I am doing my senior project on network intrusion detection system (Ethernet networks) and I am having a bit of trouble deciding if I have added enough features. Currently the system detects the ...
1
vote
1answer
240 views

Suricata rule to block particular website question

I am writing rule for suricata which is going to block the possibility to enter one of the website for example xyz.com (instead of facebook, because with facebook there are some problems). I am doing ...
8
votes
4answers
42k views

Testing Snort IDS installation

What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work? alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: ...
0
votes
1answer
278 views

Intrusion Detection System and Network Intrusion Detection Systems [duplicate]

IDS (Intrusion Detection System), NIDS (Network Intrusion Detection System) What's the difference between IDS and NIDS? Can I use more than one IDS and NIDS at the same time? Or both IDS and NIDS ...
0
votes
1answer
91 views

fwsnort - How safe compared with Snort/Suricata?

How safe is 'fwsnort' compared to a real Snort / Suricata instance? What's the percentage of VRT / ET Rules, that fwsnort can actually use? I read somewhere from an older article its only ~ 60% - is ...
0
votes
0answers
10 views

VM Introspection on Public IaaS clouds

I came across this Security SE post and a few papers on VM Introspection [1] [2] [3] What prevents cloud providers like AWS from using techniques like these to observe EC2 instance activity? If they ...
1
vote
1answer
26 views

Scan detection Tool better than Snort Portscan Preprocessor

I am working on detection of Scanning activities of Bots/Worms. I have found that Snort Portscan Preprocessor detects Scan activities. I have tweaked Snort Portscan Preprocessor to detect different ...
8
votes
3answers
331 views

Can you tell if an attack is successful by looking at IPS logs?

In my organization, we have an IPS behind a firewall. Each time a security event is triggered, I am left to wonder if the attack is really successful. For events that are set to drop in inline, we can ...
7
votes
2answers
1k views

Intrusion Prevention Logs

I received an email from a client with IDS logs. I was wondering if the following log has any real indications of the server being compromised. If there are certain things I can do to diagnose the ...
1
vote
1answer
329 views

How to capture packet using agent in JADE (Java Agent Development Framework)?

I need to design an IDS using Mobile agent. Can anyone suggest how packet capture software is efficient in JADE, how to match the captured packet for intrusion?
0
votes
0answers
12 views

Pulledpork not disabling all rules in disablesid.conf [closed]

Every time I run pulled pork, it disables 6 random rules from my disabledsid.conf and leaves the rest alone. I have hundreds of rules in the disablesid.conf and the path is correct. IE: # example ...
0
votes
0answers
28 views

How do you receive Clone Pool traffic on a Linux IDS server?

we use IDS servers with suricata on a standard Gentoo Linux. One sensor is supposed to process traffic from F5 network devices, and there is a Clone Pool configured. Clone Pools are the recommended ...
-2
votes
2answers
55 views

Limit possible harm of ransomware on a fileserver

First to say: I know I need a backup and I have one of course but my question isn't about the safety of the data but about how to reduce the possible time that is needed to restore data. I'm already ...
1
vote
2answers
50 views

What are the technical implementation differences between signature-based scanning and heuristic-based scanning?

Signature-based scanning works by comparing something to a database. So does this basically amount to scanning a file x for string foobar? I know heuristic-based scanning can detect new threats that ...
38
votes
3answers
38k views

Simple example auditd configuration?

Auditd was recommended in an answer to Linux command logging? The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, stig....
3
votes
2answers
238 views

Detecting when a screenshot is taken by a software (spyware) in Windows [closed]

Most trojaning, spyware and keylogger tools have the ability to take screenshots. Is there a way to detect if an app or software is taking a screenshot in Windows? Maybe a Windows API call or dll? ...
2
votes
1answer
3k views

Snort & Logging

I am looking for some support on using Snort in Windows 7. My experience so far is using WireShark, so this is new territory to me. I would like to use Snort to perform a trace, which, after it ends,...
5
votes
1answer
71 views

Detecting Process Hollowing

I was brainstorming methods of detecting process hollowing and other forms of code injection, and this one seemed pretty robust. Would it be possible for a "process hollowing scanner" to enumerate ...
0
votes
0answers
25 views

Process of auditd -s enable/disable persists for a long time

I have setup auditd on my system, with some basic rules from CIS Benchmark paper and the following auditd.conf file: log_file = /var/log/audit/audit.log log_format = RAW log_group = root ...
1
vote
1answer
114 views

Raspberry Pi IDS/FireWall - Should I? [closed]

I was excited to setup an IDS/FireWall with my new Raspberry Pi on a standard home network. Reading threats to SSH and Linux, now I am not so sure. Setup by an experienced amateur I'm now concerned ...
2
votes
2answers
152 views

How can the nmap tool be used to evade a firewall/IDS?

Some techniques are used to secure the operating system against network attacks e.g.: firewalls, antivirus software, an IDS like SNORT, etc. To take advantage of the nmap tool, is it possible to ...
2
votes
0answers
64 views

Snort Portscan Preprocessor Analysis

Remarks I really apologize if this content isn't matching the community, but I am not getting approved on snort-mailing lists and I don't know what can I do for the same, therefore I feel this can be ...
1
vote
2answers
31 views

Snort Unable to detect portscans in LAN

Setup Information I am doing experiment on portscan detection using snort 2.9.8.I have 10 systems in my lab with id:1,2,3,...,10. i have installed snort in my lab-pc with id:1.Now i am using Pc with ...
2
votes
1answer
63 views

Tap-mode IPS vs IDS

It is my understanding that tap mode IPS, unlike in-line mode, is passive and cannot prevent attacks. In that case, what is the difference between an IDS and a tap mode IPS? I've checked out several ...
1
vote
0answers
43 views

Inconsistent duplicate TCP packets

How often does it happen that we benignly see a TCP packet that is retransmitted but has a different payload the second time? In other words, how often is it that we see a TCP packet with sequence ...
4
votes
1answer
63 views

Do generic custom scripts avoid detection more than common security applications?

Are scripts coded only using the default API of a high level, interpreted language for generic and meticulous gathering of network device and host software information that are already available ...
0
votes
3answers
91 views

How does a hack leave no trace in server logs when there is a WORM IDS?

I am wondering if a hacker managed to either SQL inject or social engineer into a database, how does one not leave a trace in the IDS (Intrusion detection like OSSEC)? If an IDS is monitoring the ...
1
vote
0answers
53 views

Network configuration for Security Onion on VMWare ESX

I'm setting up an IDS using Security Onion on VMWare ESX. I have a VLAN from the (physical) switch which has the network SPAN port; this is feeding into the ESX virtual switch, and this port group is ...
0
votes
1answer
95 views

Understand how dionaea honeypot emulated services work

I'm trying to understand Dionaea honeypot and the information flow. I understand that it emulates some services, like SMB, ftp, tftp, try to responde with these, then gets the shellcode and ...
4
votes
1answer
68 views

Basic question about how an IDS works

Would the location of an Intrusion Detection (or Packet Analysis) sensor on an internal network impact whether the external host's Source IP (assuming inbound TCP traffic) is retrievable from a packet?...
19
votes
4answers
2k views

Detect non HTTP packets using port 80

We are currently doing port whitelisting on our firewalls which is working well but this of course does not prevent the implementation of side channels or the misuse of these ports for other purposes. ...
1
vote
0answers
33 views

Is there an easier way to test suricata has enough resources to run without losing packets?

I'd like to see the effect of changing my Suricata hardware and software, and in particular make sure I can determine the rate above which I'll start to lose data. I'm running ESXi with 20 cores and ...
6
votes
1answer
744 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
2
votes
1answer
82 views

Linux (!) Network Architecture for CTF-scenario [closed]

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
0
votes
2answers
100 views

Distinction of DPI and IDS

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in ...
0
votes
1answer
177 views

(spp_sdf) SDF Combination Alerts in Snort

I'm testing Snort in IDS mode and have been receiving a few (spp_sdf) SDF Combination Alerts as below. Seems like it happens when I visit certain but not all https sites. Tried to google this alert ...
1
vote
1answer
85 views

Are snort rules applied per packet or per flow

I would like to understand if snort rules are applied for each packet in a flow between a source and destination separately? For instance, when packet 1 of the flow arrives at the IDS, all the rules ...
0
votes
1answer
77 views

snort rule to detect relay attempt not working

I am trying to detect a relay attempt on smtp server, but nothing gets logs when I test it out. The snort rule to detect a relay attempt which I tried using is: alert tcp $SMTP_SERVERS 25 -> ...
0
votes
0answers
25 views

Snort matching against single packets

For a specific task, I'd like to match snort rules against the first 1-2 packets of each flow in the network without waiting for the other subsequent flow packets. Can I do this with snort? If so, how?...
0
votes
1answer
77 views

Do I need ossec for my personal home computer? [closed]

Do I really need a HIDS like ossec, or will using good passwords, using a firewall, an antivirus/antimalware program, and a rootkit scanner do the job well enough?
0
votes
0answers
157 views

Suricata IPS manual blocking/unblocking vs. snort and guardian

Does anyone have experience with using Suricata as an IPS? Im on Debian and I'd like to be able to manually block and unblock specific ip addresses (iptables). I've not used Suricata as I am currently ...
-1
votes
1answer
164 views

Which method is the best for IDS : heuristic or signature based? [closed]

In signature based IDS: it maintains a database of the signatures that might signal a particular type of the attack. Problems: New attack that has been specifically constructed in order to not ...
0
votes
0answers
18 views

Current Decryption Support for TLS [duplicate]

I've been locking things at clients down recently and ran into a side effect I hadn't really thought about were TLS traffic using DHE based ciphers can't be decrypted with SSLDump or Wireshark. I ...
4
votes
2answers
531 views

What is the difference between a HIDS/HIPS and an anti virus?

I have gone through what IDS/IPS's are. I understand the difference between a NIDS/NIPS and a HIDS/HIPS. But Host IDS and Host IPS sound like an antivirus software to me, is there a difference?
5
votes
1answer
322 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
6
votes
1answer
583 views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
5
votes
1answer
104 views

Using a single number instead of an IP address or a DNS name, which are concrete uses? [closed]

My question: I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to ...
1
vote
0answers
40 views

What kinds of features are useful for network security visualization? [closed]

I just want to know is network security visualization are practical for enterprise network administrators? (Which I am not) And if it is what kind of tools they uses and what kind of features they are ...
19
votes
5answers
84k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...