I am working on an IDS which has brought into the view of log analysis basically. I have to detect an intruder if there are any user behaviour anomalies present in the logs. I am having problems regarding setting rules for the Log Processing. So anybody with any suggestion about How to set the rules?

  • 1
    lol 3/3 posts to security.se have been asking the community to build this project for you. 1)sniff network, 2)???, 3)make money. – rook Jan 24 '12 at 1:44
  • what IDS are you using ? What logs are you analyzing ? What type of anomalies do you wish to be alerted on ? – Mark McDonagh Jan 24 '12 at 10:47
  • @Rock : I think u should kknow abt me first that I am a student and trying to build IDS as a final year college project and not for any money....and I have already done some research if I wanted the rules then I could have got it from many other products like ossec.net.... – Pankaj Anand Jan 24 '12 at 16:37
  • @Mark : I am not using any IDS I just am implementing it from scratch...I am analysing system-level resource and application level logs... I need to know if there is any unauthorised login and use of applications... – Pankaj Anand Jan 24 '12 at 16:44

As per my answer on your other post - have a look at the anomaly detection stuff over on the Snort forums. There are many aspects you will need to consider so try building on the work they have already done.

You will need to understand 'good traffic' for your network during the 'initial tuning' phase, use whitelists and blacklists of signatures, and then build heuristic analysis if you want to alert on deviation from the norm.

This is very resource-intensive, and complex to maintain, which is why many companies now outsource this entire piece to the big managed service providers.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.