Questions tagged [ids]
Intrusion Detection System, a system for detecting and alerting based on behavior.
421
questions
0
votes
0
answers
14
views
Nids log files step by step [closed]
Can anyone tell me what is happening here step by step:
# This text file shows a collection of log entries from the NIDS and one of the hosts on the network
# Only relevant entries are shown
#
1. 14:...
0
votes
0
answers
45
views
Why do I need an IDS/IPS in a serverless cloud environment?
Following this question (Why do we need IDS/IPS if a firewall is present?) from a few years back, I am trying to take this subject to the cloud.
Assuming that I have a fully "serverless" AWS ...
- 101
0
votes
1
answer
55
views
Can the usage of Wireshark be detected when sniffing for packets in promiscuous mode? [duplicate]
I know that port scanning can set off IDS systems on certain networks due to the suspicious traffic it generates. Can the usage of Wireshark be detected on a network? If so, will using it set off any ...
0
votes
0
answers
30
views
Are IDS/IPS already implemented on Google Cloud?
I have a partner that is asking "Do you use breach detection/prevention tools?".
I host my service on managed hosting (Heroku) and currently migrating to Google Cloud. Should I be using &...
- 101
2
votes
1
answer
69
views
What is the best way to create a PCAP file containing malicious traffic?
I'm in my last year of university and for my honour's project I am tasked with comparing two intrusion detection systems, snort and suricata, hosted on a virtual machine on my PC.
As I have no access ...
- 21
0
votes
0
answers
97
views
How to determine Snort rules source & destination IP and port
How do you figure out Snort's source & destination IP and port if the question is so vague? For example:
Write a snort rule that detects a UK NI number sent from a client's web browser to a web ...
- 1
0
votes
1
answer
154
views
suricata http rule to identify POST requests
I can’t figure it out / understand. Need to write a rule that catches an HTTP POST request from one ip address more than three times in 10 seconds and logs it.
alert http $EXTERNAL_NET any -> $...
- 1
1
vote
1
answer
160
views
Misuse vs anomaly detection alerts
Adam always reads his e-mails on Sundays around 5 pm. This Saturday,
at 11 am, he accessed his inbox. Which will generate a false positive?
Source slide 10/41
Misuse-based IDS or anomaly-based IDS? ...
- 11
0
votes
1
answer
112
views
Are sequential patterns used in practice?
I study computer security and I read articles about the potential usage of sequential pattern mining in IDPS products:
Database intrusion detection using role and user behavior based risk assessment
...
- 487
0
votes
0
answers
84
views
Is every packet of a hostile network flow hostile?
We are building a packet based anomaly detection system and I'm trying to find labeled packets.
Such dataset doesn't exist based on my search, but I can find labeled flows.
Can we say that every ...
- 101
1
vote
0
answers
84
views
Can I write a suricata rule based on the timestamp the packet arrives on the host?
We have a need to check the arrival time of two relative packets, like packet1 and packet2, if packet2 arrives too late after packet1, we want an alert for it.
Is it possible to write a rule for this? ...
- 111
1
vote
1
answer
132
views
Preventing DDOS attacks without collecting personal data? [closed]
Could anyone suggest a system to prevent DDOS attacks without collecting personal data like i.p. addresses ( or using anonymized data ) and be not deny access to an innocent user ?
1
vote
1
answer
580
views
SNORT rule for detecting/preventing unauthorized VPN or encrypted traffic
Here's my not so theoretical scenario: A day-one Trojan horse attack where the attacker sets up a secure connection back to himself using a well known trusted port, such as 80 21 443. Or for instance, ...
- 11
1
vote
0
answers
74
views
How does one label malicious traffic in generated workloads?
I have been writing on some code that automatically puts together differently parameterized attacks of common pen testing tools, i.e. sqlmap, nmap, patator etc. These attacks are then launched against ...
- 111
0
votes
1
answer
272
views
Is there any advantages in using a Network Intrusion Detection System, when already having a EDR solution?
Does implementing a Network Intrusion Detection System (NIDS) give you any advantages over an Endpoint Detection and Response (EDR) solution?
I've been trying to do research on this, but are ...
- 1
2
votes
1
answer
147
views
Processing Exceptionally High Volume Singular Flows
I wanted to know if anyone had experience sensoring single flows that generate 90 kpps or upward of traffic. My conundrum is that I use tools which I would like to be able to properly see an entire ...
- 123
0
votes
1
answer
1k
views
Suricata - How to use TCP Flags?
I wrote the following rules:
alert tcp any any -> 192.168.6.4 any (msg:"SYN"; flags: S;)
alert tcp any any -> 192.168.6.4 any (msg:"FIN"; flags: F;)
The SYN rule is matching....
- 3
1
vote
1
answer
602
views
Snort Inline Mode(IPS) Routing Packet Forwarding
I'd like to build an IPS which would be a seperate endpoint than the router and/or protected servers. To achieve this I've installed to my Ubuntu server Snort with DAQ(AFPACKET). The instructions I've ...
- 111
0
votes
1
answer
139
views
script encoder for IDS test
Encoding a payload is a means of evading antivirus or IDS.
With regard to scripts is there a way to do the same thing?
For instance, is it possible to encode a python script in order test intrusion ...
- 39
0
votes
1
answer
114
views
Help in Suricata rule bitmask syntax problem
I have written the following rule in my Suricata rules file:
alert tcp any any <> any any (flow:established; content:"|65|"; offset:0; depth:1; byte_test:1, =, 3, 2, bitmask 0x03; msg:&...
- 160
3
votes
1
answer
175
views
PCI-DSS Level 1 requirement for Intrusion Detection and Prevention on AWS API Gateway and AWS Lambda
Our architecture is based on the best practices for PCI-DSS on AWS
Amazon WAF -> API Gateway -> AWS Lambda
The lambda's are running within a VPC and the SG / Firewall and segmentation have been ...
- 153
0
votes
1
answer
229
views
Suricata Ripple20 rule for IP-in-IP resulting in 100M alerts
I found too many events in Suricata after recent update regarding this rule:
alert ip any any -> any any (msg:"ET EXPLOIT Possible CVE-2020-11900 IP-in-IP tunnel Double-Free"; ip_proto:4; ...
- 165
0
votes
0
answers
130
views
What happens if a sender changes the TCP window size over multiple packets that have the same ACK number?
I'm currently doing research on evasion attacks that seek to bypass a Deep-learning based Network Intrusion Detection System.
In order to achieve this, I need to know what the constraints are for the ...
1
vote
1
answer
507
views
Suricata and rules based on MAC address
I'm working on a project to implement SDN in a network. One of my flows is redirecting to the Suricata IDS and the flow works in layer 2 with MAC address.
Since I've read that Snort only works in ...
- 113
-1
votes
1
answer
131
views
Snort automatic protocol detection
Does Snort have the "automatic protocol detection" function like Suricata? I read that Snort 3 has "Autodetect services for portless configuration" feature. Does it mean that this ...
- 11
1
vote
2
answers
4k
views
Difference between Zeek (Bro) and Snort 3
I'm trying to find difference between Zeek and Snort 3. Сan anybody tell me what are the advantages of Zeek against Snort 3?
- 11
0
votes
1
answer
366
views
ids - How do I match any string in a list of snort contents?
If I do something like
alert tcp any any <> any any (content:"TestA"; content:"TestB"; sid:1000000; msg:"Syntax correct!";)
then the syntax is correct, but, what I would like to do is to ...
- 101
0
votes
1
answer
155
views
Is there a way to lock down a network? [closed]
If supposing I discover that my network is being attacked by some hacker or is being compromised in any way and I am able to detect it. So, is there any software-oriented way of 'locking-down' the ...
- 111
-1
votes
1
answer
303
views
Whats The Point of GeoBlocking if the Firewall Has An Implicit Deny?
What is the point of geoblocking IP addresses with cisco firepower or a similar service if the firewall would block the request anyway? For example, We only do business in the USA but see source IP's ...
- 165
2
votes
0
answers
122
views
Deciding between MDR solutions offering endpoint agents with or without an additional network appliance?
There are a number of different Managed Security Service Providers (MSSPs) offering managed detection and response services. They tend to use what is called an endpoint agent, while only some use a ...
- 21
0
votes
0
answers
89
views
Possible to verify the integrity of AIDE itself?
I recently installed the package AIDE (Advanced Intrusion Detection Environment) on my Linux server. This is a web server installed about a year ago. Since no integrity checks have been done before on ...
- 151
0
votes
1
answer
606
views
Is fail2ban an intrusion prevention system?
I know what fail2ban does; it monitors the firewall logs and finds ip addresses that have too many failed logins to ssh; and then tells the firewall to drop packets from those addresses.
So is ...
- 1,237
1
vote
0
answers
227
views
Cost range of IPS solutions [closed]
We have a client web application running in Azure Kubernetes. There was an optional requirement to implement IPS for the application. It was considered optional, because the application that we are ...
- 1,380
1
vote
0
answers
326
views
Snort Content first 3 bytes the same then create an alert [closed]
I was wondering if you could add into a snort rule the ability to only alert if the first 3 bytes match. I think I need to edit the content in my current rule content:"|37 e1 a4|"; I can add the full ...
1
vote
0
answers
258
views
FYP ideas in Applications of Machine Learning in Cyber Security domain [closed]
I am a Computer Science Engineering undergraduate aspiring to pursue a career in the field of cyber security. I have some experience in web application security, memory and network forensics fields. I ...
- 11
2
votes
0
answers
82
views
IPS solution for a medium sized web application
As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
- 1,380
5
votes
1
answer
270
views
Difference between NIDS and NBA
I'm having trouble understanding the difference between NIDS (Network-based Intrusion Detection System) and NBA (Network Behavior Analysis)
It is to my understanding that
NIDS use two detection ...
- 2,894
0
votes
0
answers
142
views
Executable scrambling with Hyperion is detected. What can I do?
I am using Hyperion v2.1 to scramble (polymorphism) some .exe file:
hyperion.exe myexefile.exe scrambled.exe
The resulting scrambled.exe file is detected and deleted by the AV or IDS system.
As ...
0
votes
1
answer
2k
views
How to create content rule in Snort
The aim is to detect, if anyone in the HOME_NET is searching for a particular term - say "terrorism" and generate an alert via a content based rule. I am using Snort 2.9 installed in a virtual ...
- 13
0
votes
0
answers
275
views
error read-file in snort when reading back pcap file
I get this error when using snort -r to read a saved pcap file and apply snort rules on it.
ERROR : pfring daq does not support read-file
I am running snort in Security Onion
I tried many things:
...
- 1
2
votes
1
answer
257
views
Centralized brute force login detection using netflow data
Is brute force login detection feasible with netflow data?
With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
- 43
2
votes
0
answers
412
views
Stateful detection in Snort
From whatever I have read of Snort, it can analyse a single packet at a time and raise an alert based on its rules.
What if I wish to have a rule based on multiple packets such as analysis of a ...
- 41
0
votes
1
answer
108
views
What does "DECed" mean in Network Security?
As in this MIB documentation: http://www.circitor.fr/Mibs/Html/F/FORTINET-FORTIGATE-MIB.php#fgIpsAnomalyDetections
fgIpsAnomalyDetections 1.3.6.1.4.1.12356.101.9.2.1.1.9
Number of intrusions DECed ...
- 103
1
vote
2
answers
2k
views
Is using a ja3 hash worth it?
I've been reading about ja3 and ja3s hashes, and although it certainly is a way to address suspicious traffic detection in encrypted traffic it still is, at least in my opinion, a static approach. It ...
- 236
0
votes
1
answer
92
views
How would you characterize a cyber surface? [closed]
Thinking through a network boundary characterization, say firewall/IDS flux. How some activity may change profile of that surface.
0
votes
0
answers
229
views
IDS/IPS payload analysis [duplicate]
While reading about IDS/IPS systems it is often mentioned that they analyze the "payload information of a packet" but what "payload" do they exactly look at?
- 236
1
vote
1
answer
504
views
Public Availability of a good Dataset in PCAP (TCPDUMP) format for IDS/IPS testing [closed]
I am trying to pass good reputable malicious traffic from an IPS. There are several sources on internet to explore datasets like the oldest I think DARPA set (not available in pcap format and not that ...
- 201
2
votes
1
answer
117
views
Confusion Matrix for Generated Signatures in Snort
How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I've seen so many papers that discuss the same, but how do ...
2
votes
1
answer
1k
views
What is an Albert sensor?
Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it?
Going purely from context, it ...
- 98.1k
0
votes
1
answer
5k
views
Snort rule for syn flood attacks - Limiting number of alerts
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, ...
- 1