Questions tagged [ids]
Intrusion Detection System, a system for detecting and alerting based on behavior.
398
questions
0
votes
0answers
26 views
How do I see the incoming traffic into my VM during the Nmap scan? [closed]
I'm testing this decoy feature from nmap, and pretend to be a bad guy. I will run it against my owned VM.
sudo nmap -sS -sV 142.93.112.115 -D 192.168.0.3,10.0.0.2,172.33.22.1
If I SSH into my ...
0
votes
0answers
32 views
IPS & HIPS on the LAN [closed]
My organization has some unusual topology that I'm unhappy with.
The main gateway (Checkpoint R80.10) firewall includes an IPS blade.
Each workstation installed with Trend Micro Apex One agent with ...
0
votes
1answer
46 views
Whats The Point of GeoBlocking if the Firewall Has An Implicit Deny?
What is the point of geoblocking IP addresses with cisco firepower or a similar service if the firewall would block the request anyway? For example, We only do business in the USA but see source IP's ...
2
votes
0answers
31 views
Deciding between MDR solutions offering endpoint agents with or without an additional network appliance?
There are a number of different Managed Security Service Providers (MSSPs) offering managed detection and response services. They tend to use what is called an endpoint agent, while only some use a ...
0
votes
0answers
24 views
Possible to verify the integrity of AIDE itself?
I recently installed the package AIDE (Advanced Intrusion Detection Environment) on my Linux server. This is a web server installed about a year ago. Since no integrity checks have been done before on ...
0
votes
1answer
92 views
Is fail2ban an intrusion prevention system?
I know what fail2ban does; it monitors the firewall logs and finds ip addresses that have too many failed logins to ssh; and then tells the firewall to drop packets from those addresses.
So is ...
1
vote
0answers
51 views
Cost range of IPS solutions [closed]
We have a client web application running in Azure Kubernetes. There was an optional requirement to implement IPS for the application. It was considered optional, because the application that we are ...
1
vote
0answers
62 views
Snort Content first 3 bytes the same then create an alert [closed]
I was wondering if you could add into a snort rule the ability to only alert if the first 3 bytes match. I think I need to edit the content in my current rule content:"|37 e1 a4|"; I can add the full ...
1
vote
0answers
59 views
FYP ideas in Applications of Machine Learning in Cyber Security domain [closed]
I am a Computer Science Engineering undergraduate aspiring to pursue a career in the field of cyber security. I have some experience in web application security, memory and network forensics fields. I ...
2
votes
0answers
42 views
IPS solution for a medium sized web application
As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
5
votes
1answer
93 views
Difference between NIDS and NBA
I'm having trouble understanding the difference between NIDS (Network-based Intrusion Detection System) and NBA (Network Behavior Analysis)
It is to my understanding that
NIDS use two detection ...
0
votes
0answers
62 views
Executable scrambling with Hyperion is detected. What can I do?
I am using Hyperion v2.1 to scramble (polymorphism) some .exe file:
hyperion.exe myexefile.exe scrambled.exe
The resulting scrambled.exe file is detected and deleted by the AV or IDS system.
As ...
0
votes
0answers
19 views
Snort stops generating alerts when HOME_NET changed to public addresses
I have used snort for traffic analysis quite often and it worked fine as it generates rules that are corresponding to packets doing malicious activities on my HOME_NET which is always private ...
0
votes
1answer
179 views
How to create content rule in Snort
The aim is to detect, if anyone in the HOME_NET is searching for a particular term - say "terrorism" and generate an alert via a content based rule. I am using Snort 2.9 installed in a virtual ...
0
votes
0answers
70 views
error read-file in snort when reading back pcap file
I get this error when using snort -r to read a saved pcap file and apply snort rules on it.
ERROR : pfring daq does not support read-file
I am running snort in Security Onion
I tried many things:
...
0
votes
0answers
42 views
Detect repeating bits with snort
I am new to snort and I am trying to make a rule that will detect repeating bits in a packet. I set it to offset to the 100th bit and the depth is 105 bits. The problem I am having is I can't figure ...
0
votes
0answers
52 views
How can I get Packet length from Suricata output?
In snort I can easely get packet length attribute (pkt_len) related to an alert. However in Suricata I don't see these information in JSON alerts (from eve.json). How can I get these information?
2
votes
1answer
118 views
Centralized brute force login detection using netflow data
Is brute force login detection feasible with netflow data?
With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
1
vote
0answers
158 views
Stateful detection in Snort
From whatever I have read of Snort, it can analyse a single packet at a time and raise an alert based on its rules.
What if I wish to have a rule based on multiple packets such as analysis of a ...
0
votes
1answer
58 views
What does “DECed” mean in Network Security?
As in this MIB documentation: http://www.circitor.fr/Mibs/Html/F/FORTINET-FORTIGATE-MIB.php#fgIpsAnomalyDetections
fgIpsAnomalyDetections 1.3.6.1.4.1.12356.101.9.2.1.1.9
Number of intrusions DECed ...
1
vote
2answers
435 views
Is using a ja3 hash worth it?
I've been reading about ja3 and ja3s hashes, and although it certainly is a way to address suspicious traffic detection in encrypted traffic it still is, at least in my opinion, a static approach. It ...
0
votes
1answer
57 views
How would you characterize a cyber surface? [closed]
Thinking through a network boundary characterization, say firewall/IDS flux. How some activity may change profile of that surface.
0
votes
0answers
73 views
IDS/IPS payload analysis [duplicate]
While reading about IDS/IPS systems it is often mentioned that they analyze the "payload information of a packet" but what "payload" do they exactly look at?
1
vote
1answer
171 views
Public Availability of a good Dataset in PCAP (TCPDUMP) format for IDS/IPS testing [closed]
I am trying to pass good reputable malicious traffic from an IPS. There are several sources on internet to explore datasets like the oldest I think DARPA set (not available in pcap format and not that ...
2
votes
1answer
52 views
Confusion Matrix for Generated Signatures in Snort
How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I've seen so many papers that discuss the same, but how do ...
2
votes
1answer
512 views
What is an Albert sensor?
Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it?
Going purely from context, it ...
0
votes
1answer
194 views
Advice to detect suspicious activities on network
A private network (about 150 PCs) is connected to the internet through an edge router. According to the net admin, his network is scanned from the outside, at the edge router. I don’t have any more ...
0
votes
1answer
2k views
Snort rule for syn flood attacks - Limiting number of alerts
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, ...
37
votes
7answers
19k views
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
...
1
vote
1answer
63 views
Multiple outbound TCP/8333 connections containing the EICAR test string
An IPS / IDS / UTM detects 50 connections from a single client containing Virus/Worm Eicar test string within half an hour. The destinations are IP addresses all around the world on port TCP/8333.
A ...
0
votes
1answer
196 views
Can Snort or Suricata *edit* packet on the fly?
I know that they can detect traffic by rules, but can they modify packets on the go?
For example, not only detecting HTTP GET but also adding headers to the GET packet.
If they can't, is there an ...
0
votes
3answers
1k views
intrusion prevention system detected “et policy pe exe” should i worry
I have a UniFi Security Gateway (USG Pro 4P) and just enabled IPS (intrusion prevention system). I am seeing many "ET POLICY PE EXE or DLL Windows file download HTTP" alerts. I have not been able to ...
1
vote
2answers
415 views
Windows process documentation for tuning Sysmon
I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
1
vote
2answers
198 views
Is there any methodology to detect smart deauthentication attack?
I'm a project student in IIT-Hyderabad. I have been working in Wifi security domain for my M.Tech. In particular, I chose de-authentication attack.
Whenever I sent De-Auth frames continuously to APs ...
4
votes
2answers
3k views
How to connect a Raspberry Pi IDS to the home router to detect intrusions network wide?
I'm configuring a raspberry pi IDS/IPS with ELK stack on a separate machine, my problem is to connecting it to the router in a way it can read traffic on the whole network and drop the suspicious ...
1
vote
1answer
143 views
Chain of causality in Equifax breach (expired certificates disabling IPS capabilities)
I am researching the Equifax breach described here:
https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
Apparently the attack went undetected for a long period of time and the ...
2
votes
1answer
127 views
sandboxing IoCs and signatures
Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain ...
3
votes
3answers
313 views
Should I block IP adresses that made attacks attempts and were block from an IPS through the rules?
We have an NIPS blocking attacks based on bad behaviors (rules checking the data in the network packets). Should I block the IP that the NIPS linked to attack attempts? It feels like the NIPS is ...
0
votes
0answers
46 views
Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?
One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
-2
votes
1answer
196 views
Penetration testing or Malware analysis? [closed]
My M.Sc research is about developing IDS for IOT.
I'm confused about which field should learn more about; penetration testing or malware analysis.
I have some knowledge about each one but for IDS, ...
0
votes
1answer
138 views
How likely is it to see a commercial IDS/IPS that uses machine learning in the near future that performs better than a normal IDS/IPS? [closed]
I have to choose a field to study on and I want to know does it worth studying in this field and will the future IDS/IPS systems be using machine-learning/deep-learning or at least how likely is it?
...
0
votes
1answer
791 views
IDS and IPS placement in network? [duplicate]
What is the good practice for the placement of IDS (NIDS) and IPS? Before the firewall or after the firewall? and why?
3
votes
2answers
563 views
How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?
I am studying SIEM tools.
Firewall logs will be different from IDS logs and even from Antivirus logs.
How can log aggregation take place?
2
votes
3answers
169 views
How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?
Threat: your Linux machine gets compromised in some way (untrusted app, or compromised install package or update, or an app is compromised because of a vulnerability, etc.) and something on your ...
0
votes
1answer
398 views
Loopback with Suricata
Is there any way of analyzing loopback traffic with Suricata?
I am trying it this way without success:
root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
0
votes
1answer
664 views
How can Insertion attack ever work and fool an IDS on a TCP connection?
An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
1
vote
0answers
162 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
0answers
445 views
How can I get Suricata to alert on 1 packet every time
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
...
1
vote
1answer
2k views
Comparison between WAF and IPS/IDS
I would like to know the difference between WAF and IPS/IDS?
Can IPS/IDS handle an attack on a web application?
If there are differences functionally between the two applications, how they work ...
3
votes
1answer
2k views
Suricata: nmap scan does not match rules
I am using suricata with emerging-scan.rules and other rules. The rules are loaded in the suricata.yaml, homenet and ext_net are configured correctly.
For testing detection of suricata I used nmap -...
