Questions tagged [anomaly-detection]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
36 views

OWASP CRS Anamoly scoring,, ModSecurity WAF

I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines : setvar:'tx....
0
votes
0answers
44 views

My PC was infected by belombrea dot com. Kaspersky didn't detect it. Is a factory reset enough? [duplicate]

Also I had it for around 3 days. It downloaded a file that's 1kb big on my PC. What should I do? I'm afraid to use my PC again.
1
vote
0answers
38 views

There is a difference between malware detection using automata and family behavior graph?

Is there a difference between dynamic malware detection using automata and family behavior - graph? I think that they are both relying on API function calls but I don't understand if there is any ...
0
votes
0answers
29 views

How to remove a very stealthy virus? [duplicate]

I have a virus on my laptop preventing me from installing antivirus, or updating windows or even opening task manager. i tried running a virus scanner from a portable scanners, the virus disappears ...
0
votes
0answers
30 views

AMSI scanning for domain specific languages

Should an application on Windows that has a DSL (domain specific language, scripting interpreter in this case) pass those scripts to AMSI for scanning, or should we restrict ourselves to more known ...
2
votes
1answer
523 views

How safe is ePSXe?

For the last few weeks, my roommate dove back into his childhood by playing his old PS1 games with an emulator I set up for him : ePSXe 2.0.5 for Windows. A few days ago, he came back to me saying ...
0
votes
0answers
49 views

Identify SSL invalid handshake using Wireshark

I am doing a research on "Network flow anomaly detection" and use Wireshark for my work. I have a problem of identifying the packets with invalid SSL/TLS handshakes. Is there a way/algorithm to detect ...
1
vote
2answers
424 views

Datasets dedicated for SIEM systems

I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
1
vote
3answers
2k views

Svchost without name 50%cpu using and can't access to “Service tab”

I have recently downloaded a trash software (even if normally I do not), and just after done an update of windows 10. After this when I was booting my computer my ventirad (I guess) was running faster ...
2
votes
0answers
31 views

How to make a succesful mimicry attack when normal clusters are very small?

Anomaly detection IDS, sometimes, are designed to prevent mimicry attacks. After the algorithm has done the clustering, there might be few and small clusters. The attacker will have problems with ...
0
votes
2answers
767 views

What do you call an antivirus that detects suspicious activity?

A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.) This does not help when defending against zero-days and ...
2
votes
1answer
70 views

How to monitor traffic/capture packets on your network?

Say you're having a basic LAN-infrastructure (a Router, a Firewall, a switch connected with multiple access points, a server and multiple clients). I want to be able to detect malicious traffic ...
1
vote
1answer
1k views

Found KeyLogger in Windows 10 OS?

I was Running Yara, The pattern matching swiss knife for malware researchers on the Windows 10. I ran a scan using rules from Yara Rules from YARA Rules Github and MalwareConfig rules. I stumbled ...
1
vote
0answers
92 views

Anomaly detection system for resource constraint nodes in IoT [closed]

I am looking for any open source implementation of anomaly based IDS for resource constrained nodes. As in Internet of things, we have heterogeneous endpoints with limited processing and storage. With ...
2
votes
0answers
351 views

Measuring real effectiveness of Machine Learning based IDS [closed]

I am currently investigation effectiveness of Intrusion Detection/Prevention Systems that are backed my Machine Learning rather than traditional Signature based detection mechanisms, so that the ...
8
votes
2answers
542 views

Anomaly-based Malware Detection in Web Applications

I am partly responsible for the security and malware detection (in general) of a huge number of hosting accounts. Our methods rely heavily on signature-based detection provided by ClamAV for which we ...
51
votes
7answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
1
vote
0answers
88 views

Does anyone know a dataset for industrial network security? [closed]

I'm trying to develop an intrusion detection for Industrial Ethernet. e.g. S7, PROFINET, Modbus protocols. I want to evaluate my work on IE security dataset. Does anyone know security dataset in this ...
2
votes
0answers
156 views

Google Chrome wants connect at unknown IP [duplicate]

On my mac when I run Google Chrome, it wants connect at unknown domain on port 80, at example some domain name are: cccpveut, fuflavlorxna, crqzzif, ecc. They appear all domain name of first level........
3
votes
3answers
584 views

Basic security checklist for using an open-source library

I've recently started working with web applications, and the ones developed by our team seem to use a lot of external components for different minor functionality (e.g. a scrolling slider bar, a ...
1
vote
1answer
149 views

How useful is Protocol Anomaly-based IDS?

Protocols such as IP, TCP, UDP, ICMP, and RPC, according to Juniper networks could potentially be useful for IDS objectives of determining the direction and test conditions. In a way, protocol anomaly-...
1
vote
0answers
501 views

Detecting Bots Who are sending Spam Mails via Webmail

I am working on spam Detection done by botnets. Some Information Recently,I came through a techique to detect the spammer in my network which is based on the anamolous amount of MX queries,outbound ...
7
votes
2answers
1k views

Detecting Process Hollowing

I was brainstorming methods of detecting process hollowing and other forms of code injection, and this one seemed pretty robust. Would it be possible for a "process hollowing scanner" to enumerate ...
2
votes
1answer
73 views

iLivid infection/ iLivid behaviour analysis

Although lots of surveys and reports have been done on iLivid by lots of malware analyzers, I decided to inspect iLivid independent of previous research. I have read lots of reports about iLivid but ...
28
votes
3answers
6k views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
0
votes
0answers
375 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My question: What is the general mechanism of ...
0
votes
1answer
732 views

Statistical Anomaly Detection with machine learning applications to IDS

as the topic says I am interested in learning more about anomaly detection in particular I am asking for good starting points and references both from a theoretical point of view and applied one. For ...
1
vote
2answers
905 views

Anomaly detection in HTTP REFERER

I'm trying to put some anomoly detection in place and I'm looking at referrer data (I know that this is optional, and can be fudged in some circumstances). But I'm seeing too many cases of what I ...