Questions tagged [ids]

Intrusion Detection System, a system for detecting and alerting based on behavior.

Filter by
Sorted by
Tagged with
22 votes
8 answers
47k views

Tracking down a rogue access point

Over the course of about a month we have received multiple reports of a rogue access point attempting to intercept traffic. I suspect an attacker is using a wifi pineapple, or similar hardware device....
user avatar
  • 1
25 votes
8 answers
31k views

Can I detect web app attacks by viewing my Apache log file? [closed]

I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
user avatar
  • 13.7k
41 votes
6 answers
241k views

Difference between IDS and IPS and Firewall

The differences between an IDS and a firewall are that the latter prevents malicious traffic, whereas the IDS: Passive IDS: the IDS only reports that there was an intrusion. Active IDS: the IDS also ...
user avatar
7 votes
2 answers
5k views

Snort Sensor Placement

I have a snort sensor monitoring some of my network being fed from a mirrored port. This mirrored session only monitors traffic between the firewall and peering switch. Since this just sees traffic ...
user avatar
  • 1,115
50 votes
3 answers
70k views

Simple example auditd configuration?

Auditd was recommended in an answer to Linux command logging? The default install on Ubuntu seems to barely log anything. There are several examples that come with it (capp.rules, nispom.rules, stig....
user avatar
  • 20.6k
14 votes
5 answers
67k views

Testing Snort IDS installation

What is the easiest way to test Snort IDS after installing? Would using and writing a rule that captures all of the traffic work? alert ip any any -> any any ( msg: "ICMP packet detected!"; sid: ...
user avatar
2 votes
1 answer
3k views

Can Snort be configured as HIDS?

I need to give a presentation regarding Snort and Security Auditing. I have recently learned to configure Snort as a NIDS. I want to know is there any way I can configure Snort as an HIDS? If I am ...
user avatar
  • 917
8 votes
2 answers
8k views

Snort rules to detect Meterpreter sessions

I am learning while configuring Snort, my setup consists in an attacker (Linux), a victim (Android smartphone) and one detection system (IDS). So far, I have been able to log all the packets between ...
user avatar
  • 81
5 votes
3 answers
6k views

NGINX Hacking Attempt

Every time I start my test-server and let it run for some days I get this in my log-files (in different variations): 111.241.26.165 - - [18/Feb/2014:22:16:45 +0100] "\x04\x01\x00\x19\xCBER!\x00" 400 ...
user avatar
  • 153
2 votes
1 answer
5k views

How does IPS terminate/decrypt encrypted traffic?

With regards to IPS, I am not completely across how they are supposed to terminate or decrypt encrypted traffic? It makes absolutely sense to deploy them inline, but how is traffic supposed to be ...
user avatar
-2 votes
5 answers
59k views

How to check if someone is in my computer [duplicate]

Igen suspect that someone is may be controlling my computer using some remote desktop app. How I check if I am right or not? My only clue is that my mouse sometimes start to move randomly (it is not ...
user avatar
3 votes
5 answers
8k views

Question about IDS and IPS

I am studying Security Fundamentals on Networks and as a part of an excercise I have the following question: Which of the following statements are true? (Select all that apply) a.- An IDS deals with ...
user avatar
  • 57
2 votes
1 answer
221 views

Could encryption become a security breach?

So, I was skimming though this SANS research about skype . Long story short, it says : Skype uses standard cryptographic primitives to achieve strong end-to-end encryption (Berson, 2005).........
user avatar
  • 359
1 vote
2 answers
6k views

NIDS/NIPS vs HIDS/HIPS

Can we interchangeably deploy a HIDS or HIPS instead of a NIDS/NIPS, what would be the risks, for example you have Symanetec EPS modules with HIPS policies enabled how are they different from a ...
user avatar
  • 29
1 vote
1 answer
3k views

IDS Snort rule to catch Slow-Loris

I'm trying to write a rule to catch a Slow-Loris attack, this is what i have - alert tcp any any -> any any (msg:"Possible Slow Loris attack"; classtype: denial-of-service; flow: to_server, ...
user avatar
23 votes
5 answers
5k views

Neural networks & anomaly detection

Neural networks, with their ability to learn behavioural patterns from arbitrary data, seem like a natural way to deal with intrusion detection. There are many academic papers on the topic which ...
user avatar
12 votes
6 answers
6k views

Applications of probability/statistics in IT security?

What are some areas of computer security that utilizes statistical modeling? I ask b/c I'm a studying statistics at school and have become interested after reading a few papers.. some of the areas I'...
user avatar
  • 223
5 votes
3 answers
3k views

Published data sets for IDS/IPS evaluation

I am looking for data sets published by researchers or freelancers which can be used for the purpose of IDS/IPS testing and evaluations. The data sets may be for portscans, DoS attacks, Remote to ...
user avatar
  • 1,818
18 votes
7 answers
4k views

Tripwire - Is it security Theater?

Tripwire type intrusion detection systems supposedly protect your system from rootkits, by monitoring the checksums of important binaries for changes. Let's say I have tripwire configured to run ...
user avatar
  • 38.7k
14 votes
2 answers
768 views

Detecting attempts to attack a website?

I am currently trying to implement some recommendations from OWASP AppSensor Project and I'd like to respond to the attacker when he tries to break into my website. Is there any resource covering/...
user avatar
  • 1,840
2 votes
2 answers
12k views

What approaches are to detect DoS attack in IDS/Firewall?

First approach to DoS attack detection: There are techniques for intrusion detection, and of course DoS attack, in which for each packet (or flow) some features are calculated, then based on some ...
user avatar
  • 353
12 votes
3 answers
711 views

Do any of you who are *really* dealing with APT have any recommended intelligence feeds for SIEM/IDS/etc?

This question about Advanced Persistent Threats (APT) was posted by Rich Mogull on twitter. I copied it here because I'm curious too. Rich posted these follow-up tweets: And by APT I mean real ...
user avatar
  • 13.7k
6 votes
1 answer
6k views

New to ossec - what does active response do out of the box

I am new to ossec. I installed the server and wui on a dedicated machine. I have agents running on my zookeeper and kafka servers to start. Below are events I am seeing. I assume the are ...
user avatar
  • 163
19 votes
4 answers
4k views

Detect non HTTP packets using port 80

We are currently doing port whitelisting on our firewalls which is working well but this of course does not prevent the implementation of side channels or the misuse of these ports for other purposes. ...
user avatar
  • 4,275
7 votes
1 answer
1k views

Tools to identify and report hacking attempts originating inside reputable organizations?

Re: Should I report hacking attempts? - Server Fault Lots of people look at their own logs for attacks from the outside. But who regularly reports such attacks back to the source? I'm mainly ...
user avatar
  • 20.6k
6 votes
3 answers
2k views

Can the IPS technology in a UTM prevent a DDoS attack?

Does a Unified Threat Management appliance (UTM) with Intrusion Prevention (IPS) enabled have the ability to prevent a DDoS attack? I have read some articles and none of them have a perfect ...
user avatar
  • 63
6 votes
2 answers
2k views

How effective is an IDS at catching targeted attacks

I have recently become very familiar with IBM Site Protector. As I understand things, Site Protector is in the top tier of IPS/IDS systems, used by some of the largest Fortune 500 companies. I was ...
user avatar
  • 3,476
4 votes
1 answer
736 views

Anomaly Intrusion Detection relevant features

I am researching on Anomaly Intrusion Detection to implement one. At this phase, I am searching for relevant features to network traffic. I found 41 features from KDD CUP'99 project (the paper: WENKE ...
user avatar
  • 353
3 votes
3 answers
5k views

Using an IPS as an alternative to mod_security

I am considering deploying mod_security as an addition to our web infrastructure. I am worried about the increased load however as these servers get a lot of hits. I am considering using IPS's such ...
user avatar
9 votes
3 answers
808 views

Popularity of Anomaly based IDSes

I've been reading quite some time about anomaly/behavior based IDSes for Web servers. I understand the downsides: possible high false positives, learning phase, constant training. My question is how ...
user avatar
5 votes
2 answers
17k views

Snort (IDS) Don't show Port Scans

I have install Snort & acidbase by this instruction and access it through this local address 127.0.0.1/acidbase/base_main.php The problem is after scan it with nmap by this command sudo ...
user avatar
1 vote
1 answer
3k views

Why aren't anomaly-based intrusion detection schemes implemented in Snort?

I have read many papers on anomaly-based network intrusion detection. Am I correct that each of their techniques could be implemented as Snort preprocessor? If this is true, why there are no anomaly ...
user avatar
  • 353
1 vote
1 answer
658 views

Can HIPS software practically be considered a form of MAC

Host Intrusion Prevention Software can restrict applications from taking certain actions regardless if they have the privileged to do so as assigned by the operating system. Given that with the use ...
user avatar
  • 3,476
5 votes
2 answers
3k views

How can an IPS\IDS detect SQLi \ XSS (or other application layer) attacks?

I've been thinking about how an IPS works, and as far as I know it inspects the packets on the TCP\IP layer. How can it detect attacks on higher levels without harming the user experience? How does ...
user avatar
  • 2,219
1 vote
1 answer
1k views

Intrusion Prevention Systems: NIPS vs NBA

I was going through the wikipedia article on Intrusion Prevention Systems. It states two of the four types of IPS as follows: Network-based intrusion prevention system (NIPS): monitors the entire ...
user avatar
  • 467
1 vote
1 answer
3k views

Snort, add TCP retransmission rule

Can somebody help me with adding rule for packet retransmission. I found some documentation about the snort rules, but I am confused how to use it. The rules which catches the packet retransmission ...
user avatar
  • 412