Questions tagged [ids]
Intrusion Detection System, a system for detecting and alerting based on behavior.
394
questions
1
vote
0answers
36 views
Cost range of IPS solutions [closed]
We have a client web application running in Azure Kubernetes. There was an optional requirement to implement IPS for the application. It was considered optional, because the application that we are ...
1
vote
0answers
50 views
Snort Content first 3 bytes the same then create an alert
I was wondering if you could add into a snort rule the ability to only alert if the first 3 bytes match. I think I need to edit the content in my current rule content:"|37 e1 a4|"; I can add the full ...
1
vote
0answers
27 views
FYP ideas in Applications of Machine Learning in Cyber Security domain [closed]
I am a Computer Science Engineering undergraduate aspiring to pursue a career in the field of cyber security. I have some experience in web application security, memory and network forensics fields. I ...
2
votes
0answers
40 views
IPS solution for a medium sized web application
As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
5
votes
1answer
79 views
Difference between NIDS and NBA
I'm having trouble understanding the difference between NIDS (Network-based Intrusion Detection System) and NBA (Network Behavior Analysis)
It is to my understanding that
NIDS use two detection ...
0
votes
0answers
58 views
Executable scrambling with Hyperion is detected. What can I do?
I am using Hyperion v2.1 to scramble (polymorphism) some .exe file:
hyperion.exe myexefile.exe scrambled.exe
The resulting scrambled.exe file is detected and deleted by the AV or IDS system.
As ...
0
votes
0answers
17 views
Snort stops generating alerts when HOME_NET changed to public addresses
I have used snort for traffic analysis quite often and it worked fine as it generates rules that are corresponding to packets doing malicious activities on my HOME_NET which is always private ...
0
votes
1answer
92 views
How to create content rule in Snort
The aim is to detect, if anyone in the HOME_NET is searching for a particular term - say "terrorism" and generate an alert via a content based rule. I am using Snort 2.9 installed in a virtual ...
0
votes
0answers
51 views
error read-file in snort when reading back pcap file
I get this error when using snort -r to read a saved pcap file and apply snort rules on it.
ERROR : pfring daq does not support read-file
I am running snort in Security Onion
I tried many things:
...
0
votes
0answers
35 views
Detect repeating bits with snort
I am new to snort and I am trying to make a rule that will detect repeating bits in a packet. I set it to offset to the 100th bit and the depth is 105 bits. The problem I am having is I can't figure ...
0
votes
0answers
48 views
How can I get Packet length from Suricata output?
In snort I can easely get packet length attribute (pkt_len) related to an alert. However in Suricata I don't see these information in JSON alerts (from eve.json). How can I get these information?
2
votes
1answer
105 views
Centralized brute force login detection using netflow data
Is brute force login detection feasible with netflow data?
With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
1
vote
0answers
110 views
Stateful detection in Snort
From whatever I have read of Snort, it can analyse a single packet at a time and raise an alert based on its rules.
What if I wish to have a rule based on multiple packets such as analysis of a ...
0
votes
1answer
56 views
What does “DECed” mean in Network Security?
As in this MIB documentation: http://www.circitor.fr/Mibs/Html/F/FORTINET-FORTIGATE-MIB.php#fgIpsAnomalyDetections
fgIpsAnomalyDetections 1.3.6.1.4.1.12356.101.9.2.1.1.9
Number of intrusions DECed ...
0
votes
2answers
266 views
ja3 hash is it worth it?
I've been reading about the ja3 and ja3s hash and although it certainly is a way to address suspicious traffic detection in encrypted traffic it still is (at least in my opinion a static approach). It ...
0
votes
1answer
56 views
How would you characterize a cyber surface? [closed]
Thinking through a network boundary characterization, say firewall/IDS flux. How some activity may change profile of that surface.
0
votes
0answers
41 views
IDS/IPS payload analysis [duplicate]
While reading about IDS/IPS systems it is often mentioned that they analyze the "payload information of a packet" but what "payload" do they exactly look at?
1
vote
1answer
103 views
Public Availability of a good Dataset in PCAP (TCPDUMP) format for IDS/IPS testing [closed]
I am trying to pass good reputable malicious traffic from an IPS. There are several sources on internet to explore datasets like the oldest I think DARPA set (not available in pcap format and not that ...
2
votes
1answer
45 views
Confusion Matrix for Generated Signatures in Snort
How do we come with True Positives and False Negatives rates when creating signatures in IDS? How do we measure the signatures efficiency? I've seen so many papers that discuss the same, but how do ...
2
votes
1answer
390 views
What is an Albert sensor?
Recent news articles have started to talk about government networks deploying "Albert sensors" (e.g., this article). What is an Albert sensor? And how effective is it?
Going purely from context, it ...
0
votes
1answer
144 views
Advice to detect suspicious activities on network
A private network (about 150 PCs) is connected to the internet through an edge router. According to the net admin, his network is scanned from the outside, at the edge router. I don’t have any more ...
0
votes
0answers
72 views
How to run a snort rule over PCAP file in Windows? [duplicate]
I have a PCAP file from CICIDS, and what I'd like to know is how can I apply the Snortrule in Windows? I've not written any custom rules myself but want to run the rules already available. For now, ...
0
votes
1answer
1k views
Snort rule for syn flood attacks - Limiting number of alerts
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood - SSH"; flags:S;
flow: stateless; detection_filter: track by_dst, ...
36
votes
6answers
18k views
Is it possible to detect 100% of SQLi with a simple regex?
I'm wondering if it is possible to detect 100% of the possible SQLi attacks using a simple regex.
In other words, using very simple PHP code as an example:
if (preg_match("/select/i", $input)) {
...
1
vote
1answer
57 views
Multiple outbound TCP/8333 connections containing the EICAR test string
An IPS / IDS / UTM detects 50 connections from a single client containing Virus/Worm Eicar test string within half an hour. The destinations are IP addresses all around the world on port TCP/8333.
A ...
0
votes
0answers
39 views
Can an IDS be used for detecting frames (not packets) from an non-authenticated station
Can an IDS, like snort, be used to detect Layer 2 network frames from a system i.e a system is trying to send a frame to the AP and whether Snort can work on the frame based on the rules?
0
votes
1answer
156 views
Can Snort or Suricata *edit* packet on the fly?
I know that they can detect traffic by rules, but can they modify packets on the go?
For example, not only detecting HTTP GET but also adding headers to the GET packet.
If they can't, is there an ...
0
votes
3answers
722 views
intrusion prevention system detected “et policy pe exe” should i worry
I have a UniFi Security Gateway (USG Pro 4P) and just enabled IPS (intrusion prevention system). I am seeing many "ET POLICY PE EXE or DLL Windows file download HTTP" alerts. I have not been able to ...
1
vote
2answers
240 views
Windows process documentation for tuning Sysmon
I recently installed Sysmon, which logs events to OSSEC and currently monitors several endpoints. I have been trying to whitelist benign processes such as Windows services. Many of these processes run ...
1
vote
2answers
138 views
Is there any methodology to detect smart deauthentication attack?
I'm a project student in IIT-Hyderabad. I have been working in Wifi security domain for my M.Tech. In particular, I chose de-authentication attack.
Whenever I sent De-Auth frames continuously to APs ...
3
votes
2answers
2k views
How to connect a Raspberry Pi IDS to the home router to detect intrusions network wide?
I'm configuring a raspberry pi IDS/IPS with ELK stack on a separate machine, my problem is to connecting it to the router in a way it can read traffic on the whole network and drop the suspicious ...
1
vote
1answer
129 views
Chain of causality in Equifax breach (expired certificates disabling IPS capabilities)
I am researching the Equifax breach described here:
https://oversight.house.gov/wp-content/uploads/2018/12/Equifax-Report.pdf
Apparently the attack went undetected for a long period of time and the ...
2
votes
1answer
112 views
sandboxing IoCs and signatures
Sandboxes are used for automated extraction of indicators of compromise (IoCs) that can be used to write signatures. Can this signature then be used, for example, on an IPS system to block certain ...
3
votes
3answers
271 views
Should I block IP adresses that made attacks attempts and were block from an IPS through the rules?
We have an NIPS blocking attacks based on bad behaviors (rules checking the data in the network packets). Should I block the IP that the NIPS linked to attack attempts? It feels like the NIPS is ...
0
votes
0answers
46 views
Why would IPS vendor provider refuse to publish SLAs to fix the published highly ranked CVEs?
One of the biggest IPS providers (top of Gartner graph for its category) is not providing SLAs for all the 7+ ranking CVEs published last year. I don't really understand why would they refuse to ...
-2
votes
1answer
157 views
Penetration testing or Malware analysis? [closed]
My M.Sc research is about developing IDS for IOT.
I'm confused about which field should learn more about; penetration testing or malware analysis.
I have some knowledge about each one but for IDS, ...
0
votes
1answer
108 views
How likely is it to see a commercial IDS/IPS that uses machine learning in the near future that performs better than a normal IDS/IPS? [closed]
I have to choose a field to study on and I want to know does it worth studying in this field and will the future IDS/IPS systems be using machine-learning/deep-learning or at least how likely is it?
...
0
votes
1answer
706 views
IDS and IPS placement in network? [duplicate]
What is the good practice for the placement of IDS (NIDS) and IPS? Before the firewall or after the firewall? and why?
3
votes
2answers
472 views
How IDS and Firewall Logs are aggregated and feed aggregated log to SIEM?
I am studying SIEM tools.
Firewall logs will be different from IDS logs and even from Antivirus logs.
How can log aggregation take place?
2
votes
3answers
159 views
How useful is it to prevent Linux applications from setting up any untrusted connections, and can it be done easily?
Threat: your Linux machine gets compromised in some way (untrusted app, or compromised install package or update, or an app is compromised because of a vulnerability, etc.) and something on your ...
0
votes
1answer
316 views
Loopback with Suricata
Is there any way of analyzing loopback traffic with Suricata?
I am trying it this way without success:
root@security-onion:/home/sar/TFM/alerts/suricata# suricata -c /etc/suricata/suricata.yaml -i ...
0
votes
1answer
533 views
How can Insertion attack ever work and fool an IDS on a TCP connection?
An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
1
vote
0answers
151 views
Snort not working with IDSWakeup
I have setup Snort with the registered user rules installed.
I tested first by making the following rule in local.rules:
alert icmp any any -> $HOME_NET any (msg:"ICMP test"; sid:10000001; rev:...
2
votes
0answers
357 views
How can I get Suricata to alert on 1 packet every time
I am trying to write a Suricata signature for testing purposes to alert every time it is triggered with a single PCAP file containing a single packet, but this is proving to be harder than I thought.
...
0
votes
1answer
2k views
Comparison between WAF and IPS/IDS
I would like to know the difference between WAF and IPS/IDS?
Can IPS/IDS handle an attack on a web application?
If there are differences functionally between the two applications, how they work ...
2
votes
1answer
2k views
Suricata: nmap scan does not match rules
I am using suricata with emerging-scan.rules and other rules. The rules are loaded in the suricata.yaml, homenet and ext_net are configured correctly.
For testing detection of suricata I used nmap -...
4
votes
4answers
1k views
Benefit of using two network interfaces for intrusion detection system
What is the benefit of using two network interfaces (management interface and sniffing interface) for an IDS such as Snort? I have used a Snort IDS where it only used one network interface for both ...
1
vote
2answers
118 views
Could an IPS have blocked an attack on a vulnerable router/firewall?
Thinking about the recent news regarding SOHO routers vulnerable to the VPNFilter attack: https://arstechnica.com/information-technology/2018/05/fbi-tells-router-users-to-reboot-now-to-kill-malware-...
2
votes
1answer
2k views
How does IPS terminate/decrypt encrypted traffic?
With regards to IPS, I am not completely across how they are supposed to terminate or decrypt encrypted traffic? It makes absolutely sense to deploy them inline, but how is traffic supposed to be ...
3
votes
0answers
86 views
PS4 gift card online purchase asked for photo ID
I purchased ps4 gift card online and they asked for ID verification. Which I have to take a photo of my ID front and back and a selfie. Is that safe and can they do anything with this information? I ...
