Re: Statistical Anomaly Analysis? "Was [more specific] Signaturevs. Protocol Analysis "

From: Xiaoyong Wu (xwu@anr.mcnc.org)
Date: 03/18/02 

Date: Mon, 18 Mar 2002 12:05:56 -0500 (EST)
From: Xiaoyong Wu <xwu@anr.mcnc.org>
To: Josh Gray <grayjr@cerias.purdue.edu>

Comments inline,
On Sat, 16 Mar 2002, Josh Gray wrote:
<snip>
>
> Basically my point is that your IDS is what you make of it. If you're
> tired of seeing the same alerts every day then disable them. If you
> want to catch new attacks play around with the signature set to detect
> more generic things. If you know your network really well then you can
> tune your IDS to look for things that shouldn't be happening.
Even just looking for things that shouldn't be happening, it will also be
a lot of alerts. A simple case is port scanning. You will definitely see a
lot of port scans day after day and that should be the things in your
policy to disallow. I don't believe you should turn those alerts off. You
might notice high volume of SNMP scans before a breakin through it. The
best way to deal with the alerts is for the IDS to group the alerts or
correlate the alerts.

> Actually, they are looking for less events. They are looking for a
> small set of very specific events, such as someone breaking your window
> or kicking your door down. If a home alarm system alerted every time
> someone knocked on your door or called and hung up you would probably be
> overwhelmed (or at least annoyed) with alarms by this system too. I
> know some police/fire departments will stop responding to these alarms
> if they go off to often.
>
That sounds interesting but it seems to be hard to abstract those simple
events for an IDS. You don't have a physical boundary for your network
such that you don't know where it's a breakin point. Intruders don't have
to break down your firewall to penetrate into your network. If you
consider a compromise of any of the system to be the breakin, it might be
already too late. Perhaps, if you knock the door loud enough, it will
trigger the home security systems. I don't have any experience with those
systems and would really interesting to see if I know how it works, how
hard it is to pass around it. Hopefully there's no security through
obscurity.

-Xiaoyong

-----------------------------------
Network Research Engineer, 919.248.1469
Advanced Network Research Group,MCNC xwu@anr.mcnc.org

Relevant Pages

  • Re: Target based IDS review and discussion in Information Security
    ... This all began in 2000 when Marty lead the IDS development effort at ... > describes alerts as they pop out of IDS consoles. ... > Roesch names two other components as integral to target based NIDS: ... > an attack on a system that cannot succeed should be demoted. ...
    (Focus-IDS)
  • Re: which attacks will generate false positive or false negative?
    ... addresses of the servers on your network that are allowed to do DNS Zone ... you first install a Network IDS, snmpwalks may trigger from your network ... Matt brings up the point of alerts to things that didn't have any ... you're not sure of the best way to tune out false positives during your ...
    (Focus-IDS)
  • Re: Recommended IPS signature set
    ... The most important factor in choosing IPS and IDS events is understanding what you are protecting and what it could cost you if one of your systems is compromised. ... an expert staff with available time may be able to process protocol anomaly alerts while a novice staff or one strapped for time may only have time to concentrate on vulnerability or exploit alerts. ... Then based on the criticality of the service and the severity of the event decide whether it should be enabled as blocking or not. ...
    (Focus-IDS)
  • Re: After getting the alerts generated by IDS how we distinguish true positive.false positive and fa
    ... After getting the alerts generated by IDS how we distinguish true ... And What we do with True Positive alerts. ... If it's a false positive for an attack to which your environment is ... False negatives are troublesome. ...
    (Pen-Test)
  • RE: IDS event filtering
    ... I think there are a few ways to filter; ... at in over a year so not sure if any backend IDS correlation. ... Deprioritize alerts on ... > Find out quickly and easily by testing it with real-world attacks ...
    (Focus-IDS)