Intrusion Detection System, a system for detecting and alerting based on behavior.

learn more… | top users | synonyms (2)

2
votes
1answer
37 views

Network Architecture for CTF-scenario [on hold]

My boss recently enrolled me in an InfoSec training. I am part of the network team, but have limited experience in InfoSec. My first assignment is to draw a layout of a network that will be used ...
0
votes
2answers
35 views

Distinction of DPI and IDS

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in ...
0
votes
1answer
12 views

(spp_sdf) SDF Combination Alerts in Snort

I'm testing Snort in IDS mode and have been receiving a few (spp_sdf) SDF Combination Alerts as below. Seems like it happens when I visit certain but not all https sites. Tried to google this alert ...
1
vote
1answer
38 views

Are snort rules applied per packet or per flow

I would like to understand if snort rules are applied for each packet in a flow between a source and destination separately? For instance, when packet 1 of the flow arrives at the IDS, all the rules ...
0
votes
1answer
43 views

snort rule to detect relay attempt not working

I am trying to detect a relay attempt on smtp server, but nothing gets logs when I test it out. The snort rule to detect a relay attempt which I tried using is: alert tcp $SMTP_SERVERS 25 -> ...
0
votes
0answers
18 views

Snort matching against single packets

For a specific task, I'd like to match snort rules against the first 1-2 packets of each flow in the network without waiting for the other subsequent flow packets. Can I do this with snort? If so, ...
0
votes
1answer
35 views

Do I need ossec for my personal home computer? [closed]

Do I really need a HIDS like ossec, or will using good passwords, using a firewall, an antivirus/antimalware program, and a rootkit scanner do the job well enough?
0
votes
0answers
47 views

Suricata IPS manual blocking/unblocking vs. snort and guardian

Does anyone have experience with using Suricata as an IPS? Im on Debian and I'd like to be able to manually block and unblock specific ip addresses (iptables). I've not used Suricata as I am currently ...
-1
votes
1answer
30 views

Which method is the best for IDS : heuristic or signature based? [closed]

In signature based IDS: it maintains a database of the signatures that might signal a particular type of the attack. Problems: New attack that has been specifically constructed in order to not ...
6
votes
1answer
356 views

How do I identify which PC made a suspicious DNS query?

Our IDS detected a suspicious DNS packet going to a Botnet (or similar). Since that DC is a recursive relay, how can we identify the client who made that request. (Windows DNS server)
0
votes
0answers
18 views

Current Decryption Support for TLS [duplicate]

I've been locking things at clients down recently and ran into a side effect I hadn't really thought about were TLS traffic using DHE based ciphers can't be decrypted with SSLDump or Wireshark. I ...
4
votes
2answers
80 views

What is the difference between a HIDS/HIPS and an anti virus?

I have gone through what IDS/IPS's are. I understand the difference between a NIDS/NIPS and a HIDS/HIPS. But Host IDS and Host IPS sound like an antivirus software to me, is there a difference?
4
votes
1answer
209 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
6
votes
1answer
516 views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
5
votes
1answer
77 views

Using a single number instead of an IP address or a DNS name, which are concrete uses? [closed]

My question: I have read that using the single number equivalent (called the "binary equivalent" by the author) of the IP address instead of the actual IP address or the domain name can be used "to ...
1
vote
0answers
39 views

What kinds of features are useful for network security visualization? [closed]

I just want to know is network security visualization are practical for enterprise network administrators? (Which I am not) And if it is what kind of tools they uses and what kind of features they are ...
18
votes
5answers
64k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...
1
vote
2answers
64 views

How eavesdropping attack takes place in network

I am learning some concepts of network security and I have the following question: One case of eavesdropping attack is that an adversary somehow places himself inside a network to order to capture ...
3
votes
1answer
6k views

IPS fail close vs IPS fail open, what are the risks and benefits?

If a desicion is to be be made on selecting a mode of fail for an inline IPS that is protecting servers, what are the criteria that should be considored for selecting one of the failure modes: 1- ...
4
votes
1answer
273 views

Anomaly intrusion detection

Anyone know which opensource network IDSs are using anomaly techniques? My project is to compare them, so if you could give me some hints, that would be much appreciated. Currently, I am looking at ...
2
votes
3answers
70 views

Multiple SSL Inspection

I want to ask you if you think that doing SSL Inspection in proxy mode (Resign) could be a problem. The scenario is the following: 1 --> 2 --> 3 Client web browsing IPS device with SSL ...
3
votes
1answer
54 views

How to make Snort not log sensitive data from the sniffed traffic?

I have Snort in my network which I use for IDS and it is residing on a VM that receives all mirrored traffic from the switch. I am having a web applications that users use and they login, operate on ...
3
votes
1answer
61 views

Detecting botnets that use HTTP instead of IRC

I know most bots use either IRC or HTTP to communicate with the C&C, and http unlike IRC can't be blocked. So if a botnet is using HTTP, how can this be prevented? Just theoretical!
0
votes
0answers
25 views

Snort arpspoof preprocessor not giving alerts

I'm attempting to use Snort to detect a simple arpspoof attack on a test network I've set up. I have the following 4 ip addresses on this network. 192.168.1.1 Router 00:18:39:EC:F5:78 192.168.1.2 ...
0
votes
1answer
63 views

Suricata rule to block particular website question

I am writing rule for suricata which is going to block the possibility to enter one of the website for example xyz.com (instead of facebook, because with facebook there are some problems). I am doing ...
0
votes
0answers
32 views

Snort rule to detect More Fragments fragbit not working

I have a Virtualbox setup with Snort running on a Windows 7 host and Kali Linux as the attacking machine, connected on an internal network. I'm investigating ways to get Snort to detect fragmentation ...
0
votes
0answers
45 views

Is EasyIDS obsolete?

I have found EasyIDS from Skynet Development recently but noticed that the latest change-log is from 2009. Does this mean it is obsolete and should not be used as it is not being kept up-to date?
0
votes
0answers
31 views

Switching from Snort rules to Emerging Threats. Is there a way to know which ET rule sid covers the same vulnerabilty as Snort rule sid?

Our company has been using the snort community rules and we have tuned our rule files over years to our specific needs. Now our company has decided to use Emerging Threats (ET) open rules. The ET ...
-2
votes
2answers
2k views

What are the difference between IPS and WAF in terms of DDoS?

I have heard about both Web Application Firewalls (WAF) and Intrusion Prevention Systems (IPS). Which is better in preventing a Distributed Denial of Service (DDoS) attack and why?
0
votes
1answer
46 views

fwsnort - How safe compared with Snort/Suricata

How safe is 'fwsnort' compared to a real Snort / Suricata instance? Whats the percentage of VRT / ET Rules, that fwsnort can actually use? I read somewhere from an older article its only ~ 60% - is ...
1
vote
0answers
11 views

Adding Windows 7 VM as a log source/forcing the IDS inline

I'm investigating ways to add my Windows 7 VM as a log source or even run that traffic through my IDS VM and then out to the internet but I'm not entirely sure how to approach it. Does anybody have ...
1
vote
1answer
16 views

IDS device behaviour

Which of the following is a reasonable response from the ids when its detects ip packets where ip source address and port is the same as the destination IP address and port A. Allow the packet to be ...
1
vote
0answers
12 views

get session data (stream data) into Snort ids [closed]

Can any one point to me where (in the code) Snort are stored just before they send to httprespect or got written to the output files? Thanks.
2
votes
0answers
42 views

Priming an IDS/IPS for an impending attack

Is there a system which can put an IDS/IPS in "high alert" mode if there information about a suspected impending attack in the near future (obtained from an external system)? I would like to know if ...
2
votes
0answers
40 views

problem blocking TCP scans by setting up honeyd in virtual environment

I am creating a virtual environment where I have created three virtual machines, CentOS as an Apache Webserver CentOs as an Attacker machine FreeBSD with Honeyd to setup Honeypot I have ...
7
votes
3answers
1k views

Out-of-the-box Network Intrusion Appliance for non-Power User

First, let me apologize if any of this question is naive or beneath the scope of this board. Bear in mind the context and that I'm asking as an attempt to exhaust all resources. Also, I understand if ...
1
vote
1answer
176 views

Host-based security architecture for web server network

I am begining with network security and after studying for a while about often used technologies I got to this architecture for my home server (sorry it is not in english). I considered 3 basic ...
2
votes
4answers
1k views

Detecting malware hidden in P2P traffic

Consider a network situation involving (only) Peer to Peer traffic in medium sized network. For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
2
votes
0answers
45 views

Extra p0f v3 fingerprints files?

p0f v3 is a passive operating system detector. The latest release is 3.08b, dating to November, 2014. Given the releases of Windows 10, multiple Linux, Firefox and Chrome versions since then, the ...
2
votes
1answer
92 views

SNORT sfportscan alert format [closed]

How can I modify the output alert from sfportscan ? Ex : output alert_csv: /var/log/snort/portscan.log timestamp,src,dst,dstport,msg OBS: I can set output for default alert file with this method ?
1
vote
2answers
965 views

Securing a Windows PC

Currently I have an "Antivirus" and Anti Malware software installed. In addition I closed all remote assistance and unused port rules on my firewall. I'd really like to get a complete as possible ...
20
votes
5answers
2k views

DoS in local network computer

I'm using Snort to study detection, and I wanted to simulate a DoS attack from the inside to another computer in my home network, but I have a question. If I start to flood the target computer with ...
14
votes
2answers
612 views

Detecting attempts to attack a website?

I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to the attacker when he tries to break into my website. Is there any resource ...
7
votes
3answers
1k views

How do I identify an unknown port/protocol that my IDS picks up?

Googling a port and protocol leads to a terse description at best, and a link farm in the average case. Most protocols on assorted, unknown high ports contain little or no plain text, and often if ...
5
votes
2answers
217 views

Ideas on how I can fragment captured network traffic?

I am trying to create a lab environment where I can analyze common IDS solutions (starting with Snort specifically) and their ability to reassemble fragmented IP trains. I have a collection of ...
-1
votes
1answer
118 views

Configuration audit for IPS/IDS [closed]

I have been given the task of configuration audit as my first task in my first job. As a challenge I have to find vulnerabilities by reading the logs of the PuTTy session and I do not have access to ...
0
votes
3answers
70 views

Difference between brute-force and dictionary-based in the mitigation process of the IPSs

I am working with Bro IDS and CIF ( cyber threat intelligence) using the Intel framework I am testing. How can I mitigate brute-force and dictionary-based attacks? I found that the mitigation ...
0
votes
1answer
51 views

Windows SQL Server Intrusion Detection [closed]

I'm looking into Snort to carry our basic intrusion detection, but finding it hard going. What other Intrusion Detection software is there that is good to use for SQL Server?
3
votes
1answer
35 views

Host Based Prevention System definition

I'm a little bit confused about what a host-based intrusion prevention system is. In order to better understand this concept, I'd like to introduce you a case. Let's say someone designed the ...
1
vote
1answer
59 views

Use of server and root certificate in ssl termination and inspection

I'm researching vendors which allow SSL termination and inspection, I came across Cisco CWSA technology, the technology was somewhat easy to understand the stuff which really boggled my mind was the ...