Questions tagged [ids]
Intrusion Detection System, a system for detecting and alerting based on behavior.
-1
votes
0answers
27 views
Need help regarding Cyber Security project on Intrusion Analysis and File Integrity Monitoring [on hold]
I want help in making a project that is
Intrusion Analysis and File Integrity Monitoring
I don't know where to begin or what to do as I am new in this cyber security field as I am a student.
At ...
-5
votes
0answers
28 views
Diagram illustration of an IDS [on hold]
This is a scenario based question.
A large corporation has hired you to develop an IDS
infrastructure for their network.
The organization has five subnets: Marketing, Research, Development,
Sales and ...
0
votes
0answers
17 views
Xfinity Router, wanting to set netflow and IDS
Currently the router/modem provides the wifi and ethernet. I have no way of sshing into it and I am not sure if it even support port mirroring.
Is there a good wifi router that I can setup after the ...
3
votes
3answers
90 views
Should I block IP adresses that made attacks attempts and were block from an IPS through the rules?
We have an NIPS blocking attacks based on bad behaviors (rules checking the data in the network packets). Should I block the IP that the NIPS linked to attack attempts? It feels like the NIPS is ...
0
votes
0answers
34 views
Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?
One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
-2
votes
1answer
44 views
Penetration testing or Malware analysis? [closed]
My M.Sc research is about developing IDS for IOT.
I'm confused about which field should learn more about; penetration testing or malware analysis.
I have some knowledge about each one but for IDS, ...
0
votes
1answer
35 views
How likely is it to see a commercial IDS/IPS that uses machine learning in the near future that performs better than a normal IDS/IPS? [closed]
I have to choose a field to study on and I want to know does it worth studying in this field and will the future IDS/IPS systems be using machine-learning/deep-learning or at least how likely is it?
...
0
votes
1answer
58 views
IDS and IPS placement in network? [duplicate]
What is the good practice for the placement of IDS (NIDS) and IPS? Before the firewall or after the firewall? and why?
3
votes
2answers
103 views
How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?
I am studying SIEM tools.
Firewall logs will be different from IDS logs and even from Antivirus logs.
How can log aggregation take place?
1
vote
3answers
75 views
How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?
Threat: your Linux machine gets compromised in some way (untrusted app, or compromised install package or update, or an app is compromised because of a vulnerability, etc.) and something on your ...
0
votes
1answer
59 views
Loopback with Suricata
Is there any way of analyzing loopback traffic with Suricata?
I am trying it this way without success:
root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
0
votes
1answer
80 views
How can Insertion attack ever work and fool an IDS on a TCP connection?
An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
0
votes
0answers
70 views
snort rules are enabled by pulledpork but in the same time are skipped?
I am using pulledpork for management of rules. I had enabled rules from 1:1000 to 1:5735 those rules are enabled but in the same time are skipped.
As output I had:
https://github.com/shirkdog/...
1
vote
0answers
40 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
0answers
113 views
How can I get Suricata to alert on 1 packet every time
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
...
0
votes
1answer
314 views
Comparison between WAF and IPS/IDS
I would like to know the difference between WAF and IPS/IDS?
Can IPS/IDS handle an attack on a web application?
If there are differences functionally between the two applications, how they work ...
0
votes
0answers
19 views
0 dynamic rules read
I am running Snort as IDS in Security Onion and get this message: 0 Dynamic rules
All SO_RULES are loaded in snort.conf in the correct path.
25867 Snort rules read
23950 detection rules
...
2
votes
1answer
340 views
Suricata: nmap scan does not match rules
I am using suricata with emerging-scan.rules and other rules. The rules are loaded in the suricata.yaml, homenet and ext_net are configured correctly.
For testing detection of suricata I used nmap -...
4
votes
4answers
838 views
Benefit of using two network interfaces for intrusion detection system
What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both ...
1
vote
2answers
87 views
Could an IPS have blocked an attack on a vulnerable router/firewall?
Thinking about the recent news regarding SOHO routers vulnerable to the VPNFilter attack: https://arstechnica.com/information-technology/2018/05/fbi-tells-router-users-to-reboot-now-to-kill-malware-...
2
votes
1answer
334 views
How does IPS terminate/decrypt encrypted traffic?
With regards to IPS, I am not completely across how they are supposed to terminate or decrypt encrypted traffic? It makes absolutely sense to deploy them inline, but how is traffic supposed to be ...
2
votes
0answers
68 views
PS4 gift card online purchase asked for photo ID
I purchased ps4 gift card online and they asked for ID verification. Which I have to take a photo of my ID front and back and a selfie. Is that safe and can they do anything with this information? I ...
1
vote
0answers
84 views
Blind XSS being intercepted by Palo Alto Tech OPs
I am doing a penetration test and I have a form that accepts any input. Whenever a form is submitted, a message of "Thank you, you will be contacted shortly" appears.
Acunetix detected a blind XSS ...
0
votes
0answers
32 views
Calculating the score for Packet Header Anomaly Detection?
I am studying the algorithm PHAD (Packet Header Anomaly Detection) for IDS. I can't understand the principle of this algorithm. Can somebody give me a practical example for calculating the score?
0
votes
0answers
81 views
SSH Tunneling Issue with Plink
so I'm trying to follow this tutorial to bypass firewalls and IDS by routing traffic through an SSH pipe and receiving a Meterpreter reverse shell (reverse_tcp) from a Windows computer across the ...
3
votes
1answer
283 views
Examples of non signature based anti-malware/anti-virus programs, IDS, & system integrity scanners
All traditional anti-virus software uses signatures to detect known malware after it has been discovered by the software companies and added to the definitions. Heuristic definitions allow a piece ...
0
votes
1answer
136 views
With an IPS in place, do we really need firewalls?
I was reading the article "Do you need an IDS or IPS, or both?"
on TechTarget. While reading the author's explanation of IPS this question hit me.
If an IPS is a control tool that uses a set of ...
0
votes
0answers
240 views
Snort.log output as unreadable symbols
I have recently installed Snort IDS on Linux Ubuntu 16.04LTS (not server), after experimenting and testing configuration in VitualBox.
After installing and successfully validating the configuration ...
6
votes
3answers
228 views
Tripwire report shows modification dates from when I was on vacation with computer shutdown at home
Tripwire report shows modification dates from when I was on vacation with computer shutdown at home - how is this possible?
here is one of many examples:
Modified object name: /lib/x86_64-linux-gnu/...
2
votes
0answers
124 views
What is the best way to test my anomaly detection system?
I have an IDS (Intrusion Detection System) built in C and I need to test it with real traffic. It is an anomaly detection system, so I need to train it with normal traffic first.
The IDS that I built ...
-2
votes
1answer
125 views
Anomaly based IDS Vs Protocol state based IDS
Is there any difference between them? On google, I can find many description about anomaly based IDS. But I can not find any description about protocol state based IDS.
2
votes
0answers
25 views
How to make a succesful mimicry attack when normal clusters are very small?
Anomaly detection IDS, sometimes, are designed to prevent mimicry attacks.
After the algorithm has done the clustering, there might be few and small clusters. The attacker will have problems with ...
0
votes
0answers
360 views
Need assistance setting up BRO (IDS) email alerts/notifications
I've subscribed and emailed the bro mailing list but have not received any replies. This is the exact same message.
I'm not getting email notifications to this email address (rich-reco@hotmail.com). ...
4
votes
2answers
1k views
What is the difference between an anti-virus and an IPS?
As I understand it, an intrusion protection system (IPS) detects anomalous behavior, does detection of protocol anomalies, and does signature filtering that blocks malware, DDoS, etc. An antivirus ...
0
votes
0answers
514 views
How do I get Snort to run in inline mode so it functions as an IPS?
I am running snort on Ubuntu 16.04 in AWS. I want to run snort in the inline mode. It was not dropping/blocking/rejecting traffic to the website on port 80. I need it to block such traffic. What ...
1
vote
1answer
714 views
IDS Snort rule to catch Slow-Loris
I'm trying to write a rule to catch a Slow-Loris attack, this is what i have -
alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, ...
-1
votes
2answers
76 views
WAF/IDS detection question
I've been writing scripts to identify WAF's on websites, and have come across one that appears, A LOT.
The HTML always looks like this:
<title>403 Forbidden</title>
</head><...
0
votes
2answers
718 views
What do you call an antivirus that detects suspicious activity?
A traditional antivirus scans data at rest and data in transit for known virus signatures. (Where "virus" includes trojans, rootkits, et al.)
This does not help when defending against zero-days and ...
1
vote
2answers
390 views
Intrusion Detection System (IDS / IPS) useful for Linux home users?
Can an Intrusion Detection System or Intrusion Prevention System (IDS / IPS) increase the security of home users using Linux?
Or is an IDS / IPS even less useful than antivirus for Linux?
Is an IDS /...
2
votes
0answers
58 views
Challenges of modern implementations of Network “Time Travel” analysis
I was reading this paper about the creation of network "time machines". This paper has some interesting ideas but they're largely applied to "traditional" network environments.
What kind of ...
0
votes
1answer
459 views
Combine SNORT detection and log with active response OSSEC
As far as i know, NIDS implemented in Network layer and HIDS in Host-based layer, Is it possible for NIDS( for example: Snort or suricata ) log that will included in HIDS(for example: OSSEC) log too ? ...
2
votes
1answer
163 views
Can dual NIC Snort machine cause threats to bypass firewall?
I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic.
Setup I am thinking about:
Snort computer with two NICs
One NIC connected to hub/tap outside firewall (...
1
vote
0answers
106 views
Identifying privilege escalation in OSSEC logs [closed]
I am working on an intrusion detection system which can prioritize and attribute the logs generated by OSSEC. So, how can I understand a privilege escalation case (or just the privileges a user has at ...
1
vote
0answers
82 views
Loki/Linux Personal Realtime IDS and/or IPS
In the old days i used to use firewall apps on windows that would have intrusion detection that would alert me while on my system and/or email. For instance, i would see a popup that says: "Warning: ...
1
vote
2answers
93 views
Job Website Identity Verification
I signed up for work at a Job Website so I can do some freelance web development. They have an option where you can verify you are a US citizen so you can apply for jobs that people asked for US ...
0
votes
2answers
135 views
The difference between DDoS attacks in the cloud computing and the traditional network infrastructure [closed]
Is there any difference between the DDoS attack in the cloud computing and traditional network in infrastructure?
What are the important features for detection these types of attack in cloud ...
-5
votes
2answers
133 views
Intrusion detection in home security suites [closed]
Emsisoft announced that internet security has been removed from their product lineup and they stick with Windows firewall and "fortify" that ("blocks illegitimate manipulations of Windows Firewall ...
0
votes
1answer
59 views
How to configure Tiger security scanner
I'm running an Arch linux machine and want to run a scan using this tool called Tiger. I saw this video where the guy teaches to install it and run. In the video it ran normally after installed. In my ...
24
votes
4answers
3k views
Reduce Noise when Penetration Testing
Recently I participated in a capture the flag competition which was attached with SOC analysis teams monitoring our traffic.
There we were told that many tools were very noisy. Eg Sqlmap which has ...
1
vote
2answers
153 views
How to detect long lived SSH sessioned
I am trying to figure out a way to detect ssh sessions that have been established over a long period of time. I seem to recall that there were ways to detect tcp connections that have been connected ...
