Questions tagged [anomaly-detection]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
38 views

There is a difference between malware detection using automata and family behavior graph?

Is there a difference between dynamic malware detection using automata and family behavior - graph? I think that they are both relying on API function calls but I don't understand if there is any ...
0
votes
0answers
29 views

How to remove a very stealthy virus? [duplicate]

I have a virus on my laptop preventing me from installing antivirus, or updating windows or even opening task manager. i tried running a virus scanner from a portable scanners, the virus disappears ...
0
votes
0answers
27 views

AMSI scanning for domain specific languages

Should an application on Windows that has a DSL (domain specific language, scripting interpreter in this case) pass those scripts to AMSI for scanning, or should we restrict ourselves to more known ...
2
votes
1answer
281 views

How safe is ePSXe?

For the last few weeks, my roommate dove back into his childhood by playing his old PS1 games with an emulator I set up for him : ePSXe 2.0.5 for Windows. A few days ago, he came back to me saying ...
0
votes
0answers
46 views

Identify SSL invalid handshake using Wireshark

I am doing a research on "Network flow anomaly detection" and use Wireshark for my work. I have a problem of identifying the packets with invalid SSL/TLS handshakes. Is there a way/algorithm to detect ...
1
vote
2answers
339 views

Datasets dedicated for SIEM systems

I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
1
vote
3answers
2k views

Svchost without name 50%cpu using and can't access to “Service tab”

I have recently downloaded a trash software (even if normally I do not), and just after done an update of windows 10. After this when I was booting my computer my ventirad (I guess) was running faster ...
2
votes
0answers
31 views

How to make a succesful mimicry attack when normal clusters are very small?

Anomaly detection IDS, sometimes, are designed to prevent mimicry attacks. After the algorithm has done the clustering, there might be few and small clusters. The attacker will have problems with ...
0
votes
2answers
762 views

What do you call an antivirus that detects suspicious activity?

A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.) This does not help when defending against zero-days and ...
2
votes
1answer
70 views

How to monitor traffic/capture packets on your network?

Say you're having a basic LAN-infrastructure (a Router, a Firewall, a switch connected with multiple access points, a server and multiple clients). I want to be able to detect malicious traffic ...
1
vote
1answer
964 views

Found KeyLogger in Windows 10 OS?

I was Running Yara, The pattern matching swiss knife for malware researchers on the Windows 10. I ran a scan using rules from Yara Rules from YARA Rules Github and MalwareConfig rules. I stumbled ...
1
vote
0answers
92 views

Anomaly detection system for resource constraint nodes in IoT [closed]

I am looking for any open source implementation of anomaly based IDS for resource constrained nodes. As in Internet of things, we have heterogeneous endpoints with limited processing and storage. With ...
2
votes
0answers
347 views

Measuring real effectiveness of Machine Learning based IDS [closed]

I am currently investigation effectiveness of Intrusion Detection/Prevention Systems that are backed my Machine Learning rather than traditional Signature based detection mechanisms, so that the ...
8
votes
2answers
535 views

Anomaly-based Malware Detection in Web Applications

I am partly responsible for the security and malware detection (in general) of a huge number of hosting accounts. Our methods rely heavily on signature-based detection provided by ClamAV for which we ...
51
votes
7answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
1
vote
0answers
85 views

Does anyone know a dataset for industrial network security? [closed]

I'm trying to develop an intrusion detection for Industrial Ethernet. e.g. S7, PROFINET, Modbus protocols. I want to evaluate my work on IE security dataset. Does anyone know security dataset in this ...
2
votes
0answers
133 views

Google Chrome wants connect at unknown IP [duplicate]

On my mac when I run Google Chrome, it wants connect at unknown domain on port 80, at example some domain name are: cccpveut, fuflavlorxna, crqzzif, ecc. They appear all domain name of first level........
3
votes
3answers
542 views

Basic security checklist for using an open-source library

I've recently started working with web applications, and the ones developed by our team seem to use a lot of external components for different minor functionality (e.g. a scrolling slider bar, a ...
1
vote
1answer
148 views

How useful is Protocol Anomaly-based IDS?

Protocols such as IP, TCP, UDP, ICMP, and RPC, according to Juniper networks could potentially be useful for IDS objectives of determining the direction and test conditions. In a way, protocol anomaly-...
1
vote
0answers
493 views

Detecting Bots Who are sending Spam Mails via Webmail

I am working on spam Detection done by botnets. Some Information Recently,I came through a techique to detect the spammer in my network which is based on the anamolous amount of MX queries,outbound ...
7
votes
2answers
1k views

Detecting Process Hollowing

I was brainstorming methods of detecting process hollowing and other forms of code injection, and this one seemed pretty robust. Would it be possible for a "process hollowing scanner" to enumerate ...
2
votes
1answer
71 views

iLivid infection/ iLivid behaviour analysis

Although lots of surveys and reports have been done on iLivid by lots of malware analyzers, I decided to inspect iLivid independent of previous research. I have read lots of reports about iLivid but ...
27
votes
3answers
5k views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
0
votes
0answers
367 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My question: What is the general mechanism of ...
0
votes
1answer
730 views

Statistical Anomaly Detection with machine learning applications to IDS

as the topic says I am interested in learning more about anomaly detection in particular I am asking for good starting points and references both from a theoretical point of view and applied one. For ...
1
vote
2answers
894 views

Anomaly detection in HTTP REFERER

I'm trying to put some anomoly detection in place and I'm looking at referrer data (I know that this is optional, and can be fudged in some circumstances). But I'm seeing too many cases of what I ...