I am learning at school about attack signatures on web applications (basically OWASP), but I do not understand what they really are in this context. Can anybody give me some good references where I can better understand what they are and where they are used? Thanks!


Attack signatures in the context of network intrusion detection (especially in relation to web applications) are heuristics and data patterns that can be used to identify traffic that constitutes an attack.

For example, the regex pattern union\s+select could be used to (albeit very naively) detect SQL injection attacks. Another pattern might simply be 0x31303235343830303536, which is a value that Havij (a SQL injection tool) uses in its requests.

Signatures don't have to be related to application data. They could also be based upon packet flags, patterns of traffic (e.g. lots of unexpected DNS response packets), bad login attempts, etc.

These signatures combined can form the backbone of an Intrusion Detection System (IDS), which relies upon these patterns and heuristics in order to identify attacks and alert the administrator.

| improve this answer | |
  • Thank you very much for the explanation. Can you recommend me some books/articles/websites where I can get more details on this subject and maybe some simple (very simple) implementations? I've already googled this, but couldn't find something concrete. I guess I might have not searched the right thing properly. – user2435860 Jan 25 '14 at 10:57

Not the answer you're looking for? Browse other questions tagged or ask your own question.