Hot answers tagged

3

So in overall,which one should I prefer ? You should prefer the one where you are able to deal with the logs and how much security you need and how much time you can invest to deal with false positives. Static signatures will fail to catch new attacks but have usually less false positives. Heuristics might catch more new malware but this usually comes ...


2

Stream. Here is a good document regarding how snort uses libpcap to apply heuristic and signature based anomoly detection to network traffic; http://www.pearsonhighered.com/samplechapter/157870281X.pdf and when in doubt consult the manual https://www.snort.org/faq/readme-stream5


1

HIDS is very much overkill for a home PC unless you are doing something super-sensitive. More importantly though, HIDS is reactive and to react, you have to monitor it. So the HIDS app is only a part of the solution. You need event reporting and collation and you need both eyes on the output and a way to do something if you get an event. I've seen far too ...



Only top voted, non community-wiki answers of a minimum length are eligible