Value of "richer" signatures?

From: Ken Arora (kenarora@olympus-mons.net)
Date: 06/20/02 

Date: 20 Jun 2002 19:09:28 -0000
From: Ken Arora <kenarora@olympus-mons.net>
To: focus-ids@securityfocus.com
('binary' encoding is not supported, stored as-is)

Hi,

  I'm just getting to learn about the IDS space, and have looked at some
the exploits and Snort/Arachnid signatures to identify them. While I was
researching, I was slightly surprised to see that most of the IDS's out
there used simple string matches for signatures (at least in the payload)
There were a few efforts to try and handle more complex signatures (some
companies talk of "regular expression" level of signatures).

I wanted to find out if you (especially those of you who come up with such
signatures) thought that such sophisticated signature vocabularies were
useful/worth pursuing? Looking at some of the exploits, I can see where
finding a string "in context" (context might be "these two string on the
same line" or "this string in the context of a GIF comment field" or ...)
might be useful, at least to eliminate false positives, maybe as the only
way of dealing with more subtle attacks?

If more of the IDS software out there could do this, would we see more
advanced signatures? (is this just a chicken-and-egg problem?) How
useful would they be, in the real world?

Thanks!
--ken

Relevant Pages