Questions tagged [anomaly-detection]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1 vote
1 answer
131 views

Understanding XDR Detection Methods

I'm interested in security and redteaming in particular, and as I'm learning about the subject I'm trying to find out what kind of things a blue team EDR/XDR solution will look for as part of its ...
Rajman's user avatar
  • 11
0 votes
1 answer
419 views

Misuse vs anomaly detection alerts

Adam always reads his e-mails on Sundays around 5 pm. This Saturday, at 11 am, he accessed his inbox. Which will generate a false positive? Source slide 10/41 Misuse-based IDS or anomaly-based IDS? ...
Team B.I's user avatar
0 votes
0 answers
139 views

Is every packet of a hostile network flow hostile?

We are building a packet based anomaly detection system and I'm trying to find labeled packets. Such dataset doesn't exist based on my search, but I can find labeled flows. Can we say that every ...
user128576's user avatar
1 vote
1 answer
1k views

OWASP CRS Anomaly scoring, ModSecurity WAF

I'm getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines: setvar:'tx....
Murad's user avatar
  • 11
0 votes
0 answers
45 views

My PC was infected by belombrea dot com. Kaspersky didn't detect it. Is a factory reset enough? [duplicate]

Also I had it for around 3 days. It downloaded a file that's 1kb big on my PC. What should I do? I'm afraid to use my PC again.
JasonSamPeter's user avatar
1 vote
0 answers
92 views

There is a difference between malware detection using automata and family behavior graph?

Is there a difference between dynamic malware detection using automata and family behavior - graph? I think that they are both relying on API function calls but I don't understand if there is any ...
Gavriel Sayag's user avatar
0 votes
0 answers
32 views

How to remove a very stealthy virus? [duplicate]

I have a virus on my laptop preventing me from installing antivirus, or updating windows or even opening task manager. i tried running a virus scanner from a portable scanners, the virus disappears ...
doubler's user avatar
2 votes
1 answer
2k views

How safe is ePSXe?

For the last few weeks, my roommate dove back into his childhood by playing his old PS1 games with an emulator I set up for him : ePSXe 2.0.5 for Windows. A few days ago, he came back to me saying ...
Larry N.'s user avatar
0 votes
0 answers
144 views

Identify SSL invalid handshake using Wireshark

I am doing a research on "Network flow anomaly detection" and use Wireshark for my work. I have a problem of identifying the packets with invalid SSL/TLS handshakes. Is there a way/algorithm to detect ...
Dilini Madumini's user avatar
4 votes
2 answers
2k views

Datasets dedicated for SIEM systems [closed]

I am looking for data sets published by researchers or freelancers which can be used for the purpose of SIEM testing and evaluations. The goal is to test the classification (and later correlation) for ...
U. User's user avatar
  • 190
1 vote
3 answers
3k views

Svchost without name 50%cpu using and can't access to "Service tab"

I have recently downloaded a trash software (even if normally I do not), and just after done an update of windows 10. After this when I was booting my computer my ventirad (I guess) was running faster ...
Chaveex's user avatar
  • 21
2 votes
0 answers
82 views

How to make a succesful mimicry attack when normal clusters are very small?

Anomaly detection IDS, sometimes, are designed to prevent mimicry attacks. After the algorithm has done the clustering, there might be few and small clusters. The attacker will have problems with ...
Aizzaac's user avatar
  • 121
0 votes
2 answers
889 views

What do you call an antivirus that detects suspicious activity?

A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.) This does not help when defending against zero-days and ...
lofidevops's user avatar
  • 3,620
2 votes
1 answer
128 views

How to monitor traffic/capture packets on your network?

Say you're having a basic LAN-infrastructure (a Router, a Firewall, a switch connected with multiple access points, a server and multiple clients). I want to be able to detect malicious traffic ...
Programmer1994's user avatar
1 vote
1 answer
2k views

Found KeyLogger in Windows 10 OS?

I was Running Yara, The pattern matching swiss knife for malware researchers on the Windows 10. I ran a scan using rules from Yara Rules from YARA Rules Github and MalwareConfig rules. I stumbled ...
Sam Arnold's user avatar
1 vote
0 answers
142 views

Anomaly detection system for resource constraint nodes in IoT [closed]

I am looking for any open source implementation of anomaly based IDS for resource constrained nodes. As in Internet of things, we have heterogeneous endpoints with limited processing and storage. With ...
baymax Robo's user avatar
2 votes
0 answers
426 views

Measuring real effectiveness of Machine Learning based IDS [closed]

I am currently investigation effectiveness of Intrusion Detection/Prevention Systems that are backed my Machine Learning rather than traditional Signature based detection mechanisms, so that the ...
user3727438's user avatar
8 votes
2 answers
673 views

Anomaly-based Malware Detection in Web Applications

I am partly responsible for the security and malware detection (in general) of a huge number of hosting accounts. Our methods rely heavily on signature-based detection provided by ClamAV for which we ...
McJohnson's user avatar
  • 292
1 vote
0 answers
141 views

Does anyone know a dataset for industrial network security? [closed]

I'm trying to develop an intrusion detection for Industrial Ethernet. e.g. S7, PROFINET, Modbus protocols. I want to evaluate my work on IE security dataset. Does anyone know security dataset in this ...
met1366's user avatar
  • 11
2 votes
0 answers
297 views

Google Chrome wants connect at unknown IP [duplicate]

On my mac when I run Google Chrome, it wants connect at unknown domain on port 80, at example some domain name are: cccpveut, fuflavlorxna, crqzzif, ecc. They appear all domain name of first level........
Stackuser's user avatar
3 votes
3 answers
925 views

Basic security checklist for using an open-source library

I've recently started working with web applications, and the ones developed by our team seem to use a lot of external components for different minor functionality (e.g. a scrolling slider bar, a ...
Jedi's user avatar
  • 3,976
1 vote
1 answer
210 views

How useful is Protocol Anomaly-based IDS?

Protocols such as IP, TCP, UDP, ICMP, and RPC, according to Juniper networks could potentially be useful for IDS objectives of determining the direction and test conditions. In a way, protocol anomaly-...
BitsInForce's user avatar
1 vote
0 answers
560 views

Detecting Bots Who are sending Spam Mails via Webmail

I am working on spam Detection done by botnets. Some Information Recently,I came through a techique to detect the spammer in my network which is based on the anamolous amount of MX queries,outbound ...
user10012's user avatar
  • 191
7 votes
2 answers
2k views

Detecting Process Hollowing

I was brainstorming methods of detecting process hollowing and other forms of code injection, and this one seemed pretty robust. Would it be possible for a "process hollowing scanner" to enumerate ...
exosphere's user avatar
2 votes
1 answer
131 views

iLivid infection/ iLivid behaviour analysis

Although lots of surveys and reports have been done on iLivid by lots of malware analyzers, I decided to inspect iLivid independent of previous research. I have read lots of reports about iLivid but ...
Mohammadreza's user avatar
34 votes
4 answers
11k views

Which security measures does PyPI and similar third-party software repositories take?

PyPI is a third-party software repository for Python packages. Everybody can upload packages to it (see The Python Package Index (PyPI)). How does PyPI prevent people from uploading malware? When I ...
Martin Thoma's user avatar
  • 3,956
0 votes
0 answers
450 views

The simplest way to emulate TCP-IP protocol violation / anomaly attacks

Reading up upon security on web applications I did not found that much info on TCP-IP and in particular HTTP/UDP protocol violation / anomaly attacks. My question: What is the general mechanism of ...
Mindaugas Bernatavičius's user avatar
0 votes
1 answer
790 views

Statistical Anomaly Detection with machine learning applications to IDS

as the topic says I am interested in learning more about anomaly detection in particular I am asking for good starting points and references both from a theoretical point of view and applied one. For ...
sh0t's user avatar
  • 1
1 vote
2 answers
1k views

Anomaly detection in HTTP REFERER

I'm trying to put some anomoly detection in place and I'm looking at referrer data (I know that this is optional, and can be fudged in some circumstances). But I'm seeing too many cases of what I ...
symcbean's user avatar
  • 18.6k