A message from our CEO about the future of Stack Overflow and Stack Exchange. Read now.

Questions tagged [detection]

Detection is the act of discovering and/or determining the existence, presence, or fact of something.

20 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3
votes
0answers
63 views

What caused these massive spikes in malware sites detected by Google in July 2012 and January-February 2014?

Google's Transparency Report shows pretty huge spikes in malware sites detected by crawlers in July 2012 and in January/February 2014. I can't find any record of what these spikes were caused by ...
3
votes
0answers
57 views

Obscuring/detecting changes to a digital photograph

Note: I'm asking this here because it seems to be a better fit for security than for photography, since it deals with data manipulation and forensics. With so much of our modern security based on ...
2
votes
0answers
233 views

What is the best way to test my anomaly detection system?

I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first. The IDS that I built ...
2
votes
0answers
105 views

Rogue Containment on a wired network (mostly)

I work as a security analyst for a large company. The answer must provide remote support. We are currently looking to build a piece of software (integrating existing products with home grown ...
1
vote
0answers
46 views

What makes detection of optimized-away memory clearing non-trivial?

In this 35C3 talk, it is said that while it is possible to manually inspect whether a package optimizes away memset() that clears sensitive memory, doing it automatically would be challenging. ...
1
vote
0answers
157 views

Snort not working with IDSWakeup

I have setup Snort with the registered user rules installed. I tested first by making the following rule in local.rules: alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
1
vote
0answers
161 views

Which Anti-Virus companies share their signature databases?

I recently heard that AVG and AVAST shared their malware signature databases (avast forum) Which AV vendors share their signature databases or use the same engine for detecting malwares? Based on ...
1
vote
0answers
262 views

How can XML External Entity attacks be detected?

XML External Entity attacks have been identified as an OWASP top 10 web application vulnerability. Whilst there seems to be extensive information on what an XML external entity attack is and how it ...
1
vote
0answers
318 views

Heuristic Malware Detection Methods

I would like to know some basic heuristic detection methods in detail because when I do research there is only a general overview of heuristics and not what methods are used to achieve it. I would ...
1
vote
0answers
190 views

Airgapped network security: feasable to prevent precompiled code from running to limit vulnerability to hacked firmware?

I'm not sure if this is the right medium to ask this but I'm looking for pointers or if this is being done. I realize that this is still a bit of a open question. When internal network holds critical ...
0
votes
1answer
123 views

What is “rule-based” analysis in malware detection?

I've read a few articles that describe the heuristic detection used by AVs as being either "weight-based" or "rule-based". The weight-based aspect seems to make sense, but I don't understand what "...
0
votes
0answers
48 views

Antivirus and it's role in detecting payload execution?

My first question is this: 1) Antivirus software works using signature based detection. Signature based detection evaluates items (maybe not the right word?) based upon a big database of known threats....
0
votes
0answers
55 views

Detecting cracked Themida packed malware

I'm working in a large SOC and my manager has tasked me with finding some way to provide coverage for Themida packed malware samples. As alluring as it is to suggest just blacklisting all Themida ...
0
votes
0answers
40 views

Assess anti-malware detection techniques

Are there any known, conventional, ways of assessing the types of detection techniques an endpoint security product might employ? I know AV-Test and AV-Comparatives exist to test the effectiveness of ...
0
votes
1answer
2k views

Snort rule for syn flood attacks - Limiting number of alerts

So I have a snort rule that detects syn flood attacks that looks like this: alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S; flow: stateless; detection_filter: track by_dst, ...
0
votes
0answers
160 views

Heuristics-based vs behavioral malware detection

I'm working on my thesis and I have a couple questions about differences between heuristics-based and behavioral malware detection. Does heuristics-based detection rely only on statically examining ...
0
votes
0answers
51 views

Detecting network attacks by processing individual or multiple network packets?

I am trying to create a tool that identifies network attacks using machine learning, something like a small intrusion detection system. I have collected benign traffic from the network and then ...
-1
votes
1answer
143 views

Audio steganography and DRM

I recently made a post about an audio steganography program and had another concern I thought I might ask. I understand that most music has DRM in them. If I hide secret files in audio files with DRM ...
-1
votes
1answer
1k views

How to detect a Dionaea Honeypot, is it possible or not?

There is a question like this but the answers aren't sufficient to me. I am interested in a honeypot project and I use the dionaea honeypot. This project is really cool, but there is a problem. How ...
-2
votes
1answer
82 views

Trying to detect a firewall

I have some HTML that was detected by one of my scripts firewall detections, it looks like this: <!--- HTTP 1.1 Status Code: 403 HTTP Headers: {'Content-Length': '1233', 'X-Powered-By': 'ASP.NET', ...