Intrusion Detection Systems
10
votes
9answers
6k views
Tracking down a rogue access point
Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware ...
16
votes
2answers
8k views
Simple example auditd configuration?
Auditd was recommended in an answer to Linux command logging?
The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, ...
-2
votes
6answers
2k views
How to check if someone is in my computer
Igen suspect that someone is may be controlling my computer using some remote desktop app. How I check if I am right or not?
My only clue is that my mouse sometimes start to move randomly (it is not ...
10
votes
6answers
690 views
Applications of probability/statistics in IT security?
What are some areas of computer security that utilizes statistical modeling? I ask b/c I'm a studying statistics at school and have become interested after reading a few papers.. some of the areas ...
12
votes
5answers
376 views
Neural networks & anomaly detection
Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
12
votes
7answers
995 views
Tripwire - Is it security Theater?
Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes.
Let's say I have tripwire configured to run ...
10
votes
2answers
374 views
Detecting website attack attempts
I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to attacker, when he tries to break into my website. Is there any resource ...
10
votes
3answers
376 views
Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc?
This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter. I copied it here because I'm curious too.
Rich posted these follow-up tweets:
And by APT I mean real ...
5
votes
3answers
8k views
Testing a Snort IDS installation
What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work?
alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: ...
1
vote
2answers
299 views
Published data sets for IDS/IPS evaluation
I am looking for data sets published by researchers or freelancers which can be used for the purpose of IDS/IPS testing and evaluations. The data sets may be for portscans, DoS attacks, Remote to ...
4
votes
2answers
491 views
How effective is an IDS at catching targeted attacks
I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies.
I was ...
5
votes
1answer
520 views
Tools to identify and report hacking attempts originating inside reputable organizations?
Re: Should I report hacking attempts? - Server Fault
Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
3
votes
1answer
243 views
Anomaly Intrusion Detection relevant features
I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic.
I found 41 features from KDD CUP'99 project (the paper: WENKE ...
1
vote
2answers
433 views
What approaches are to detect DoS attack in IDS/Firewall?
First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
7
votes
3answers
338 views
Popularity of Anomaly based IDSes
I've been reading quite some time about anomaly/behavior based IDSes for Web servers.
I understand the downsides: possible high false positives, learning phase, constant training.
My question is how ...
5
votes
2answers
569 views
Snort Sensor Placement
I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
1
vote
1answer
126 views
Snort, add TCP retransmission rule
Can somebody help me with adding rule for packet retransmission.
I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...
1
vote
1answer
158 views
Can HIPS software practically be considered a form of MAC
Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system.
Given that with the use ...
0
votes
1answer
259 views
Why aren't anomaly-based intrusion detection schemes implemented in Snort?
I have read many papers on anomaly-based network intrusion detection. Am I correct that each of their techniques could be implemented as Snort preprocessor? If this is true, why there are no anomaly ...
0
votes
0answers
106 views
KDD CUP'99 flag feature's trouble with prevension [closed]
In KDD CUP'99 dataset, "flag" feature refers to "normal or error status of the connection",
which should changes as the TCP connection state changes. However in the training dataset it refers to the ...
