Hot answers tagged

4

Before categorising anything, it's important to understand the taxonomy first. That way you don't get bogged down in words that could have different meanings. An IPS or an IDS is defined as a network-level detection control. A Host-Based IPS (HIPS) will also look at internal data but primarily looks at the network. Given this differentiation, no, fail2ban ...


4

NIDS are designed to inspect the network at certain points, like at ingress/egress points in the network. Its focus is intrusion. Yes, there are signature rules and there are anomaly rule sets, but they focus on the point where traffic passes the NIDS inspection point. NBA looks at the network. It's looking at bandwidth and protocol use and other factors ...


3

Any chance it's this: https://www.cisecurity.org/services/albert/ ? It says it's a Suricata based IDS (not clear to me what they add to plain Suricata, maybe this is a subscription to threat signature updates?).


2

If the hash is only used by itself to distinguish between malicious and non-malicious applications then it is probably not very effective since as you've said already hashes from various applications are overlapping which means that one gets either false positives or false negatives. But the hash might be used in context with other features, like the domain ...


2

It most likely means "Decoded" in this context, as "decoder" is the language keyword Fortinet uses to describe their anomaly detection: The FortiGate IPS uses protocol decoders to identify the abnormal traffic patterns that do not meet the protocol requirements and standards. For example, the HTTP decoder monitors the HTTP traffic to identify any ...


1

For testing, a simple google search was done in the web browser (firefox). Search engines today are usually accessed by HTTPS (and this is definitely true with Google). in HTTPS all the HTTP is encrypted which includes the full HTTP request (i.e. the part containing the string "HTTP") and also what is searched for. Given that Snort only sees the encrypted ...


1

In general security systems, in this case NIDS, that detect things needs to deals with false positive and negatives. JA3 is a new technique that allows NIDS (snort, suricata, aiengine and others) to detect malware before they send the HTTP exploit. Of course if somebody design a malware that use the same settings as chrome or firefox then the signature will ...


1

I believe the OP is referring to a concept I usually call "Attack Surface" Attack surface is mental visualization tool used to picture the aggregation of all the various vectors an adversary might use or attempt to use to affect the confidentiality, availability or integrity of your data or systems. To envision an attack surface one should visualize the ...


1

Here is a list of some of the ones I use: https://www.netresec.com/?page=PcapFiles https://iscxdownloads.cs.unb.ca/iscxdownloads/CICAndMal2017/PCAPs/ https://github.com/bro/bro/tree/master/testing/btest/Traces http://traces.cs.umass.edu/index.php/Network/Network https://github.com/markofu/pcaps https://ant.isi.edu/datasets/requests.html https://mcfp.felk....


1

How do we measure the signatures efficiency? You don't want too much false positives, or your users will be impacted for being denied access to legitimate sites. On the other hand, false negatives allows attackers to bypass the filters and attack your infrastructure. So an IDS with the lowest false positives/negatives rates is better than the others. how ...


1

The "ET POLICY" part of the alert is telling you that it's a 'Policy' rule: i.e. it's not an attack per se, it's just something which might violate a corporate policy. That particular alert is just telling you that someone has downloaded a Windows executable file or DLL over HTTP. In most cases this is just noise, unless you've prohibited downloading of ...


1

Maybe it's too late to come up with an answer here. But, I think I should write this to present my approach which might be helpful to the beginners trying to find the catch. Snort can be configured only as a Network IDS and not Host IDS considering the fact that it's only capable of watching the network traffic and not what happens inside of the HOST. You ...


1

They now even suggest sharing your ID via their "share link" feature. From their post about this: https://threema.ch/en/blog/posts/share-link-en To streamline the process of adding contacts to Threema and to make it easier to share one’s own ID, there is now a unique Share Link for each Threema ID.... Their example: https://threema.id/ECHOECHO


Only top voted, non community-wiki answers of a minimum length are eligible