I am working on an IDS which has brought into the view of log analysis basically. I have to detect an intruder if there are any user behaviour anomalies present in the logs. I am having problems regarding setting rules for the Log Processing. So anybody with any suggestion about How to set the rules?
4
-
1lol 3/3 posts to security.se have been asking the community to build this project for you. 1)sniff network, 2)???, 3)make money.– rookCommented Jan 24, 2012 at 1:44
-
what IDS are you using ? What logs are you analyzing ? What type of anomalies do you wish to be alerted on ?– Mark McDonaghCommented Jan 24, 2012 at 10:47
-
@Rock : I think u should kknow abt me first that I am a student and trying to build IDS as a final year college project and not for any money....and I have already done some research if I wanted the rules then I could have got it from many other products like ossec.net....– Pankaj AnandCommented Jan 24, 2012 at 16:37
-
@Mark : I am not using any IDS I just am implementing it from scratch...I am analysing system-level resource and application level logs... I need to know if there is any unauthorised login and use of applications...– Pankaj AnandCommented Jan 24, 2012 at 16:44
Add a comment
|
1 Answer
As per my answer on your other post - have a look at the anomaly detection stuff over on the Snort forums. There are many aspects you will need to consider so try building on the work they have already done.
You will need to understand 'good traffic' for your network during the 'initial tuning' phase, use whitelists and blacklists of signatures, and then build heuristic analysis if you want to alert on deviation from the norm.
This is very resource-intensive, and complex to maintain, which is why many companies now outsource this entire piece to the big managed service providers.
answered Jan 24, 2012 at 11:37
