Questions tagged [ids]

Intrusion Detection System, a system for detecting and alerting based on behavior.

Filter by
Sorted by
Tagged with
0
votes
0answers
16 views

Auto updating attack signature Firewall, WAF, IPS & IDS to secure Azure services?

We have a need to secure the Application Gateway and hundreds of APIs exposed to the Internet as part of our production environment. Using the existing built-in, Azure services, how to make it secure ...
1
vote
0answers
36 views

PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda

Our architecture is based on the best practices for PCI-DSS on AWS Amazon WAF -> API Gateway -> AWS Lambda The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
0
votes
0answers
35 views

Implement IPS (Intrusion Prevention System) on Kubernetes

This a bit of a broad question, I know. Our security team at work gave us the task to implement an IPS (Intrusion Prevention System) for our infrastructure and no specs (surprise!). We have several ...
0
votes
1answer
84 views

Suricata Ripple20 rule for IP-in-IP resulting in 100M alerts

I found too many events in Suricata after recent update regarding this rule: alert ip any any -> any any (msg:"ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"; ip_proto:4; ...
0
votes
0answers
42 views

What happens if a sender changes the TCP window size over multiple packets that have the same ACK number?

I'm currently doing research on evasion attacks that seek to bypass a Deep-learning based Network Intrusion Detection System. In order to achieve this, I need to know what the constraints are for the ...
1
vote
1answer
88 views

Suricata and rules based on MAC address

I'm working on a project to implement SDN in a network. One of my flows is redirecting to the Suricata IDS and the flow works in layer 2 with MAC address. Since I've read that Snort only works in ...
-1
votes
1answer
55 views

Snort automatic protocol detection

Does Snort have the "automatic protocol detection" function like Suricata? I read that Snort 3 has "Autodetect services for portless configuration" feature. Does it mean that this ...
1
vote
2answers
426 views

Difference between Zeek (Bro) and Snort 3

I'm trying to find difference between Zeek and Snort 3. Сan anybody tell me what are the advantages of Zeek against Snort 3?
0
votes
0answers
33 views

Snort analyze reply based on request

I'm trying to write a snort rule which detects if certain binary files where requested via HTTP based on a regex rule matching there names. But it should only send an alert if the file exists (e.g. ...
0
votes
1answer
42 views

ids - How do I match any string in a list of snort contents?

If I do something like alert tcp any any <> any any (content:"TestA"; content:"TestB"; sid:1000000; msg:"Syntax correct!";) then the syntax is correct, but, what I would like to do is to ...
0
votes
1answer
114 views

Is there a way to lock down a network? [closed]

If supposing I discover that my network is being attacked by some hacker or is being compromised in any way and I am able to detect it. So, is there any software-oriented way of 'locking-down' the ...
-1
votes
1answer
72 views

Whats The Point of GeoBlocking if the Firewall Has An Implicit Deny?

What is the point of geoblocking IP addresses with cisco firepower or a similar service if the firewall would block the request anyway? For example, We only do business in the USA but see source IP's ...
2
votes
0answers
50 views

Deciding between MDR solutions offering endpoint agents with or without an additional network appliance?

There are a number of different Managed Security Service Providers (MSSPs) offering managed detection and response services. They tend to use what is called an endpoint agent, while only some use a ...
0
votes
0answers
31 views

Possible to verify the integrity of AIDE itself?

I recently installed the package AIDE (Advanced Intrusion Detection Environment) on my Linux server. This is a web server installed about a year ago. Since no integrity checks have been done before on ...
0
votes
1answer
128 views

Is fail2ban an intrusion prevention system?

I know what fail2ban does; it monitors the firewall logs and finds ip addresses that have too many failed logins to ssh; and then tells the firewall to drop packets from those addresses. So is ...
1
vote
0answers
78 views

Cost range of IPS solutions [closed]

We have a client web application running in Azure Kubernetes. There was an optional requirement to implement IPS for the application. It was considered optional, because the application that we are ...
1
vote
0answers
80 views

Snort Content first 3 bytes the same then create an alert [closed]

I was wondering if you could add into a snort rule the ability to only alert if the first 3 bytes match. I think I need to edit the content in my current rule content:"|37 e1 a4|"; I can add the full ...
1
vote
0answers
111 views

FYP ideas in Applications of Machine Learning in Cyber Security domain [closed]

I am a Computer Science Engineering undergraduate aspiring to pursue a career in the field of cyber security. I have some experience in web application security, memory and network forensics fields. I ...
2
votes
0answers
42 views

IPS solution for a medium sized web application

As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
5
votes
1answer
131 views

Difference between NIDS and NBA

I'm having trouble understanding the difference between NIDS (Network-based Intrusion Detection System) and NBA (Network Behavior Analysis) It is to my understanding that NIDS use two detection ...
0
votes
0answers
70 views

Executable scrambling with Hyperion is detected. What can I do?

I am using Hyperion v2.1 to scramble (polymorphism) some .exe file: hyperion.exe myexefile.exe scrambled.exe The resulting scrambled.exe file is detected and deleted by the AV or IDS system. As ...
0
votes
1answer
280 views

How to create content rule in Snort

The aim is to detect, if anyone in the HOME_NET is searching for a particular term - say "terrorism" and generate an alert via a content based rule. I am using Snort 2.9 installed in a virtual ...
0
votes
0answers
96 views

error read-file in snort when reading back pcap file

I get this error when using snort -r to read a saved pcap file and apply snort rules on it. ERROR : pfring daq does not support read-file I am running snort in Security Onion I tried many things: ...
2
votes
1answer
136 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
2
votes
0answers
198 views

Stateful detection in Snort

From whatever I have read of Snort, it can analyse a single packet at a time and raise an alert based on its rules. What if I wish to have a rule based on multiple packets such as analysis of a ...
0
votes
1answer
62 views

What does “DECed” mean in Network Security?

As in this MIB documentation: http://www.circitor.fr/Mibs/Html/F/FORTINET-FORTIGATE-MIB.php#fgIpsAnomalyDetections fgIpsAnomalyDetections 1.3.6.1.4.1.12356.101.9.2.1.1.9 Number of intrusions DECed ...
1
vote
2answers
627 views

Is using a ja3 hash worth it?

I've been reading about ja3 and ja3s hashes, and although it certainly is a way to address suspicious traffic detection in encrypted traffic it still is, at least in my opinion, a static approach. It ...
0
votes
1answer
57 views

How would you characterize a cyber surface? [closed]

Thinking through a network boundary characterization, say firewall/IDS flux. How some activity may change profile of that surface.
0
votes
0answers
106 views

IDS/IPS payload analysis [duplicate]

While reading about IDS/IPS systems it is often mentioned that they analyze the "payload information of a packet" but what "payload" do they exactly look at?
1
vote
1answer
248 views

Public Availability of a good Dataset in PCAP (TCPDUMP) format for IDS/IPS testing [closed]

I am trying to pass good reputable malicious traffic from an IPS. There are several sources on internet to explore datasets like the oldest I think DARPA set (not available in pcap format and not that ...
2
votes
1answer
59 views

Confusion Matrix for Generated Signatures in Snort

How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I've seen so many papers that discuss the same, but how do ...
2
votes
1answer
653 views

What is an Albert sensor?

Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it? Going purely from context, it ...
0
votes
1answer
241 views

Advice to detect suspicious activities on network

A private network (about 150 PCs) is connected to the internet through an edge router. According to the net admin, his network is scanned from the outside, at the edge router. I don’t have any more ...
0
votes
1answer
3k views

Snort rule for syn flood attacks - Limiting number of alerts

So I have a snort rule that detects syn flood attacks that looks like this: alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S; flow: stateless; detection_filter: track by_dst, ...
37
votes
7answers
22k views

Is it possible to detect 100% of SQLi with a simple regex?

I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex. In other words, using very simple PHP code as an example: if (preg_match("/select/i", $input)) { ...
1
vote
1answer
85 views

Multiple outbound TCP/8333 connections containing the EICAR test string

An IPS / IDS / UTM detects 50 connections from a single client containing Virus/Worm Eicar test string within half an hour. The destinations are IP addresses all around the world on port TCP/8333. A ...
0
votes
1answer
239 views

Can Snort or Suricata *edit* packet on the fly?

I know that they can detect traffic by rules, but can they modify packets on the go? For example, not only detecting HTTP GET but also adding headers to the GET packet. If they can't, is there an ...
0
votes
3answers
2k views

intrusion prevention system detected “et policy pe exe” should i worry

I have a UniFi Security Gateway (USG Pro 4P) and just enabled IPS (intrusion prevention system). I am seeing many "ET POLICY PE EXE or DLL Windows file download HTTP" alerts. I have not been able to ...
1
vote
2answers
793 views

Windows process documentation for tuning Sysmon

I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
1
vote
2answers
261 views

Is there any methodology to detect smart deauthentication attack?

I'm a project student in IIT-Hyderabad. I have been working in Wifi security domain for my M.Tech. In particular, I chose de-authentication attack. Whenever I sent De-Auth frames continuously to APs ...
4
votes
2answers
4k views

How to connect a Raspberry Pi IDS to the home router to detect intrusions network wide?

I'm configuring a raspberry pi IDS/IPS with ELK stack on a separate machine, my problem is to connecting it to the router in a way it can read traffic on the whole network and drop the suspicious ...
1
vote
1answer
156 views

Chain of causality in Equifax breach (expired certificates disabling IPS capabilities)

I am researching the Equifax breach described here: https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf Apparently the attack went undetected for a long period of time and the ...
2
votes
1answer
157 views

sandboxing IoCs and signatures

Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain ...
3
votes
3answers
349 views

Should I block IP adresses that made attacks attempts and were block from an IPS through the rules?

We have an NIPS blocking attacks based on bad behaviors (rules checking the data in the network packets). Should I block the IP that the NIPS linked to attack attempts? It feels like the NIPS is ...
0
votes
0answers
46 views

Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?

One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
-2
votes
1answer
284 views

Penetration testing or Malware analysis? [closed]

My M.Sc research is about developing IDS for IOT. I'm confused about which field should learn more about; penetration testing or malware analysis. I have some knowledge about each one but for IDS, ...
0
votes
1answer
178 views

How likely is it to see a commercial IDS/IPS that uses machine learning in the near future that performs better than a normal IDS/IPS? [closed]

I have to choose a field to study on and I want to know does it worth studying in this field and will the future IDS/IPS systems be using machine-learning/deep-learning or at least how likely is it? ...
0
votes
1answer
870 views

IDS and IPS placement in network? [duplicate]

What is the good practice for the placement of IDS (NIDS) and IPS? Before the firewall or after the firewall? and why?
3
votes
2answers
686 views

How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?

I am studying SIEM tools. Firewall logs will be different from IDS logs and even from Antivirus logs. How can log aggregation take place?
2
votes
3answers
177 views

How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?

Threat: your Linux machine gets compromised in some way (untrusted app, or compromised install package or update, or an app is compromised because of a vulnerability, etc.) and something on your ...

1
2 3 4 5
9