Intrusion Detection Systems
11
votes
2answers
3k views
How do Intrusion Detection Systems (IDS) work?
How do Intrusion Detection Systems (IDS) work? As I understand it, they monitor network traffic but what exactly do they look for? How can they tell apart regular activity from intrusions?
0
votes
0answers
12 views
Should signature based NIDS detect malicious documents or executable malwares? [duplicate]
Two kinds of client side attacks are explained here, offensive-security.com: (1) just binary payloads and (2) exploit+payloads. Is it the responsibility of NIDS to detect them? It is the payload or ...
-1
votes
0answers
25 views
How to make sure my NIDS can detect recent exploits/vulnerabilities?
Is there any way other than installing the vulnerable OS and application, then running the exploit (published in exploit-db.com) to check whether my configured IDS could detect it or not? I mean, ...
-6
votes
0answers
80 views
Intrusion detection system - Design and Analysis [closed]
There is a corporation, say Fizzy Drinks, that has a network suited in a single building. The scope of the corporation is to build up an Intrusion Detection System , to monitor that a rival ...
5
votes
2answers
115 views
Out-of-the-box Network Intrusion Appliance for non-Power User
First, let me apologize if any of this question is naive or beneath the scope of this board. Bear in mind the context and that I'm asking as an attempt to exhaust all resources.
Also, I understand if ...
1
vote
1answer
68 views
What is the best place to put my IDS network sensor? [duplicate]
I can only place a single network sensor somewhere within my network. Would it be best placed between the border router and firewall, or between the firewall internal LAN?
1
vote
1answer
158 views
snort ignores packets with matching src/dest IP address
This is my rule:
alert udp 192.168.1.1 4000 -> 192.168.1.1 7000 (msg:"This rule doesn't work"; sid:1234567;)
I am running snort against a precaptured packet file where there are UDP packets that ...
1
vote
0answers
97 views
Security Onion:snorby alerts shows all local nerwork source IP(public and private)
I have just installed Security Onion distro based on ubuntu. This distro does a great job of combining multiple tools like snort/suricata,sguil,snorby,elsa,bro ids,squert. In my Security Onion ...
1
vote
2answers
536 views
What approaches are to detect DoS attack in IDS/Firewall?
First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
1
vote
1answer
396 views
Snort/IDS detect and alert on possible DoS/DDoS attack?
As per the title, I'm attempting to configure Snort to detect and alert on a incoming Denial of Service attack.
Looking at the rulesets, which are primarily signature based rules, I can't see a ...
2
votes
2answers
159 views
Example of malware that spreads via USB? [closed]
I'm messing with Mandiant Redline on Windows Server 2012 in a VM and I wanted to download a sample virus that spreads via USB and modify it to attack Mandiant Redline - I've never written malware ...
4
votes
1answer
58 views
Security / logging on a Xen-based VPS instance?
Our company has a Xen-based instance on a VPS provider and we have some sensitive data stored on it. Is there a way for me to tell if/when employees of the hosting company have accessed my VPS (by ...
19
votes
7answers
4k views
Can I detect web app attacks by viewing my Apache log file?
I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
8
votes
3answers
265 views
What are the pros/cons of using a threat detection system?
What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)?
What does a properly implemented threat detection system do and how does it behave when it detects ...
-2
votes
6answers
3k views
How to check if someone is in my computer
Igen suspect that someone is may be controlling my computer using some remote desktop app. How I check if I am right or not?
My only clue is that my mouse sometimes start to move randomly (it is not ...
0
votes
1answer
40 views
How to specify a Snort rule connection duration?
Is it even possible to specify into a snort rule the duration of a connection?
For example: in this format Hour, Minute, Second
H, M, S = 0, 2, 1
If a connection that has the duration of 2 minutes ...
2
votes
1answer
112 views
How to add wildcards to snort rule ip address?
Is it possible to add wildcards or something that would function like them to a snort rule IP address?
For example:
If I'd like to detect source-ip of: 192.168.*.9
where the third octet can be ...
14
votes
5answers
4k views
Do you detect/react to DNS tunnelling?
I've just seen a talk about tunnelling TCP/IP over DNS requests, because port 53 UDP is usually open and unfiltered. What techniques exist to detect and block such tunnels, and have you ever seen that ...
4
votes
1answer
86 views
Integrity check against package repository?
I have a Debian installed. When there are security updates, I review and install them as soon as possible and think about using automatic updates.
From time to time I want to boot from a clean boot ...
2
votes
1answer
151 views
Does Verizon Wireless LTE network have intrusion prevention capabilities?
Can someone tell me whether or not Verizon Wireless's LTE network has an IDS/IPS capability? I'm trying to compare the security of their CDMA/LTE network to others that are GSM.
EDIT for clarity: I ...
1
vote
2answers
99 views
SYN scan, TCP packet question
during SYN scans, many small tcp packets are sent to multiple ports to determine which ports are open or not. But when you're streaming media, aren't you receiving many
One type of ID system, the ...
3
votes
1answer
260 views
Are Kismet (on OpenWRT) and Snort IDS (on a linux server) compatitble?
I'm trying to develop an IDS/IPS system project to include these elements:
A router running OpenWRT running Kismet drone (Attitude Adjustment 12.09rc1)
A Linux server (Running Kismet server + client)
...
2
votes
1answer
190 views
Does Web Apps and Databases running on AWS EC2 need a IDS/IPS?
I have googled around for information about Web Apps or Databases running on AWS EC2 needing a IDS/IPS or not.
I will present my findings so far here, but it will be good if you guys can confirm ...
2
votes
1answer
374 views
Snort (IDS) Don't show Port Scans
I have install Snort & acidbase by this instruction and access it through this local address
127.0.0.1/acidbase/base_main.php
The problem is after scan it with nmap by this command
sudo ...
1
vote
2answers
110 views
Intrusion Prevention Systems: NIPS vs NBA
I was going through the wikipedia article on Intrusion Prevention Systems.
It states two of the four types of IPS as follows:
Network-based intrusion prevention system (NIPS): monitors the entire ...
3
votes
2answers
237 views
Why does layer 2 IDS seem underdeveloped compared to layer 3 IDS, for wireless network?
I understand that there are many applications such as Snort that do the job for network layer 3 IDS.
From what I have researched, layer 2 wireless IDS seems like a field that is very slow in ...
-1
votes
1answer
89 views
Solutions to TCP FIN Host Sweep (Signature 3032)
The Intrusion Prevention System is giving me an attack with signature 3032, TCP FIN Host Sweep on one of the ip addresses. I need a solution or recommendation on how to avoid the TCP FIN Host Sweep.
1
vote
1answer
148 views
Snort, add TCP retransmission rule
Can somebody help me with adding rule for packet retransmission.
I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...
5
votes
2answers
212 views
How did Evernote detect the security breach?
http://blog.evernote.com/blog/2013/03/02/security-notice-service-wide-password-reset/
Evernote's official message says little about technical details of the attack and how it was detected.
...
-3
votes
1answer
112 views
What's the best IDS for my machine? [closed]
I'm looking for free IDS that sniffs to traffic in real time.. Can anyone help me !
1
vote
1answer
84 views
how to handle error reply messages?
For security reasons, many organizations do not allow error reply messages to leave their internal Internets. How, specifically, could hackers use information in echo reply messages to learn about the ...
1
vote
1answer
96 views
How to capture packet using agent in JADE (Java Agent Development Framework)?
I need to design an IDS using Mobile agent. Can anyone suggest how packet capture software is efficient in JADE, how to match the captured packet for intrusion?
1
vote
2answers
159 views
What type of data does Snort log?
This is new to me, but what types of data does Snort log for Network Intrusion Detection?
I am guessing time stamp, source IP address, destination IP address, source port, destination port, protocol. ...
2
votes
4answers
354 views
Detecting malware hidden in P2P traffic
Consider a network situation involving (only) Peer to Peer traffic in medium sized network.
For the sake of convenience, a simple P2P application like DC++ may be assumed, although I am aiming at a ...
5
votes
3answers
9k views
Testing a Snort IDS installation
What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work?
alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: ...
1
vote
2answers
1k views
Snort false positive?
I've set up snort and am configuring it for my network. I have one vpn server making a connection to my dns/AD server. This connection sets off:
GPL SHELLCODE x86 inc ebx NOOP
The payload is as ...
5
votes
1answer
96 views
Symbiote Counter-Attack Detection
I saw this video on YouTube about hacking Cisco phones (and other embedded systems) and I was overjoyed when the presenter not only hacked, but presented a security solution. Intrigued, I started ...
1
vote
1answer
190 views
How to find IPS events in sonicwall syslog
I have a sonicwall os firewall, and the security dashboard shows about 9 intrusion prevention events in the last month. Most are called "Suspicious CIFS traffic 4". I have syslog servers setup with ...
1
vote
1answer
152 views
Working of WAF/IDS/IPS payload normalization schemes?
I want to know how WAF/IDS/IPS deals with Payload Transformations. Such payload transformations may be
base64Encode
html EntityDecode
url Encode
Remove whitespaces
I want to know how WAF/IDS/IPS ...
1
vote
1answer
105 views
how to protect from Network scanner on android?
How can I block and detect network scanners on android platforms to stop scanning vlan of my hot spot.
My question is:
which scanners they use?
how can i detect such scanners?
Can i protect ...
2
votes
2answers
296 views
Where can I find worm traffic sample?
I have a program that has to detect scanning activity of worms.
I need some samples of worms' traffic (pcap files) to try the program, and notes about the procedures which must be taken when running ...
0
votes
0answers
99 views
Why there exists time-based features in KDD CUP'99? [closed]
In KDD CUP'99 there are time-based features calculated in last 2 seconds. But in the dataset there is only on record for a 8000 seconds long telnet connection. Shouldn't there exists a record for each ...
3
votes
1answer
255 views
Anomaly Intrusion Detection relevant features
I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic.
I found 41 features from KDD CUP'99 project (the paper: WENKE ...
-3
votes
2answers
129 views
anomaly detection: feature calculation problem [closed]
I have a question about how to calculate features selected in [ 1 ]. It assumes that the impact of DoS attack on features are nSrcs=nDsts=1, nPkts/sec>a, nSYN/Pkts>b, ... (Table 1 of [ 1 ])
...
0
votes
1answer
149 views
Network anomaly detection or anomaly-based intrusion detection?
When implementing anomaly-based intrusion detection system, if I want to dismiss U2R and R2L attacks (to avoid deep packet inspection), and to consider only Probe and DoS attacks, what features should ...
0
votes
1answer
117 views
Why unsupervised anomaly-based intrustion detection training data should be normal or less noisy
I recently read a paper which stated that "Traditional anomaly detection algorithms require a set of purely normal data from which they train their model" [1]. But as in K-means, or other unsupervised ...
0
votes
1answer
135 views
How does an IDS system use PCAP to process malicious signatures?
I have been wondering exactly how does an IDS system use packet captures (PCAP) to process and alert of malicious signatures?
0
votes
0answers
77 views
Intrusion Detection/Prevention, Autonegotiation and Network Taps [closed]
I'm setting up a hardware security appliance intrusion detection device (IDS) in monitor-mode (i.e., not inline), and I suspect I'm having some problems with Gigabit ethernet autonegotiation on a ...
0
votes
0answers
110 views
KDD CUP'99 flag feature's trouble with prevension [closed]
In KDD CUP'99 dataset, "flag" feature refers to "normal or error status of the connection",
which should changes as the TCP connection state changes. However in the training dataset it refers to the ...
0
votes
1answer
282 views
Why aren't anomaly-based intrusion detection schemes implemented in Snort?
I have read many papers on anomaly-based network intrusion detection. Am I correct that each of their techniques could be implemented as Snort preprocessor? If this is true, why there are no anomaly ...
