Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [anomaly-detection]

The tag has no usage guidance.

0
votes
0answers
22 views

What use-cases can be determined, for anomaly-based intrusion detection, for a web and mobile network traffic? [on hold]

I have to apply machine learning algorithms to detect anomalies in network traffic. My network architecture is composed of a web server (linux), reverse proxy (F5), firewalls (CISCO ASA, Fortigate), ...
0
votes
0answers
72 views

Facebook AI constantly “Detects suspicious activity” = locked account [closed]

Super tired of Facebook locking my account after declaring it's detected suspicious activity. Don't want to use it at all, but pretty much have to. :( Have 2FA turned on (Google Auth), so: 1) Not on ...
2
votes
1answer
63 views

How safe is ePSXe?

For the last few weeks, my roommate dove back into his childhood by playing his old PS1 games with an emulator I set up for him : ePSXe 2.0.5 for Windows. A few days ago, he came back to me saying ...
0
votes
0answers
31 views

Identify SSL invalid handshake using Wireshark

I am doing a research on "Network flow anomaly detection" and use Wireshark for my work. I have a problem of identifying the packets with invalid SSL/TLS handshakes. Is there a way/algorithm to detect ...
1
vote
1answer
134 views

Datasets dedicated for SIEM systems

I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
1
vote
3answers
1k views

Svchost without name 50%cpu using and can't access to “Service tab”

I have recently downloaded a trash software (even if normally I do not), and just after done an update of windows 10. After this when I was booting my computer my ventirad (I guess) was running faster ...
2
votes
0answers
31 views

How to make a succesful mimicry attack when normal clusters are very small?

Anomaly detection IDS, sometimes, are designed to prevent mimicry attacks. After the algorithm has done the clustering, there might be few and small clusters. The attacker will have problems with ...
0
votes
2answers
733 views

What do you call an antivirus that detects suspicious activity?

A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.) This does not help when defending against zero-days and ...
2
votes
1answer
66 views

How to monitor traffic/capture packets on your network?

Say you're having a basic LAN-infrastructure (a Router, a Firewall, a switch connected with multiple access points, a server and multiple clients). I want to be able to detect malicious traffic ...
1
vote
1answer
830 views

Found KeyLogger in Windows 10 OS?

I was Running Yara, The pattern matching swiss knife for malware researchers on the Windows 10. I ran a scan using rules from Yara Rules from YARA Rules Github and MalwareConfig rules. I stumbled ...
1
vote
0answers
87 views

Anomaly detection system for resource constraint nodes in IoT [closed]

I am looking for any open source implementation of anomaly based IDS for resource constrained nodes. As in Internet of things, we have heterogeneous endpoints with limited processing and storage. With ...
2
votes
0answers
323 views

Measuring real effectiveness of Machine Learning based IDS [closed]

I am currently investigation effectiveness of Intrusion Detection/Prevention Systems that are backed my Machine Learning rather than traditional Signature based detection mechanisms, so that the ...
8
votes
2answers
466 views

Anomaly-based Malware Detection in Web Applications

I am partly responsible for the security and malware detection (in general) of a huge number of hosting accounts. Our methods rely heavily on signature-based detection provided by ClamAV for which we ...
52
votes
7answers
11k views

Why does one need a strong password on Unix?

SSH Server: I only allow public key authentication. Malicious Software: If it's running as my user it has access to my data and an internet connection, it's bad enough already. Yes, su access would ...
1
vote
0answers
77 views

Does anyone know a dataset for industrial network security? [closed]

I'm trying to develop an intrusion detection for Industrial Ethernet. e.g. S7, PROFINET, Modbus protocols. I want to evaluate my work on IE security dataset. Does anyone know security dataset in this ...
2
votes
0answers
117 views

Google Chrome wants connect at unknown IP [duplicate]

On my mac when I run Google Chrome, it wants connect at unknown domain on port 80, at example some domain name are: cccpveut, fuflavlorxna, crqzzif, ecc. They appear all domain name of first level........
3
votes
3answers
431 views

Basic security checklist for using an open-source library

I've recently started working with web applications, and the ones developed by our team seem to use a lot of external components for different minor functionality (e.g. a scrolling slider bar, a ...
1
vote
1answer
136 views

How useful is Protocol Anomaly-based IDS?

Protocols such as IP, TCP, UDP, ICMP, and RPC, according to Juniper networks could potentially be useful for IDS objectives of determining the direction and test conditions. In a way, protocol anomaly-...
1
vote
0answers
443 views

Detecting Bots Who are sending Spam Mails via Webmail

I am working on spam Detection done by botnets. Some Information Recently,I came through a techique to detect the spammer in my network which is based on the anamolous amount of MX queries,outbound ...
8
votes
2answers
1k views

Detecting Process Hollowing

I was brainstorming methods of detecting process hollowing and other forms of code injection, and this one seemed pretty robust. Would it be possible for a "process hollowing scanner" to enumerate ...
2
votes
1answer
55 views

iLivid infection/ iLivid behaviour analysis

Although lots of surveys and reports have been done on iLivid by lots of malware analyzers, I decided to inspect iLivid independent of previous research. I have read lots of reports about iLivid but ...
26
votes
3answers
4k views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
0
votes
0answers
353 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My question: What is the general mechanism of ...
0
votes
1answer
723 views

Statistical Anomaly Detection with machine learning applications to IDS

as the topic says I am interested in learning more about anomaly detection in particular I am asking for good starting points and references both from a theoretical point of view and applied one. For ...
1
vote
2answers
811 views

Anomaly detection in HTTP REFERER

I'm trying to put some anomoly detection in place and I'm looking at referrer data (I know that this is optional, and can be fudged in some circumstances). But I'm seeing too many cases of what I ...