Re: Signature Counts between IDS's

From: Huagang Xie (huagang@intruvert.com)
Date: 09/12/02 

From: Huagang Xie <huagang@intruvert.com>
To: SEdwards@toplayer.com
Date: Wed, 11 Sep 2002 16:55:34 -0700

IMO, An IDS signature coverage will count in to 2 category, one is the
coverage of the real exploit code, or real vulnerability exploit code,
and another one is the protocol anomaly signatures which is also
important for you to capture the unknown attacks or the attacks you do
not defined a signature to cover it.

Huagang

SEdwards@toplayer.com wrote:

>Has anyone ever done a comparison between ISS & Snort on signature counts -
>so which product has the most sigs (and how many) - and which sigs match
>which in the two products
>
>Thanks
>
>Simon
>________________________________________________
>Simon Edwards
>Technical Evangelist
>Top Layer Networks
>US Office : + 1 508 870 1300 (x230)
>US Mobile : + 1 617 953 8764
>UK Office : + 44 1483 243 549
>UK Mobile : + 44 7971 959170
>www: www.TopLayer.com
>email: sedwards@toplayer.com
>
>"Perfecting the Art of Network Security"
>----------------------------------------------------------------------------
>--------
>
>
>

Quantcast