RE: "False postive" database idea

From: Anton A. Chuvakin (anton_at_chuvakin.org)
Date: 09/24/03

  • Next message: Keith W. McCammon: "Re: Multiple network segment monitor with Snort" 
    Date: Wed, 24 Sep 2003 12:02:07 -0400 (EDT)
To: "Chad I. Uretsky" <c.uretsky@netiq.com>

    Chad and all,

    >What is to prevent someone from crafting a new attack, checking what it's
    >signature looks like in a NIDS, then submitting that signature for insertion
    >into the database? If the database were then updated with such a signature,
    >those utilizing the database to identify "false positives" would identify
    >the signature of such an attack as a false positive.
    Well, a database (as envisioned) should require one more critical
    component to utilize effectively - a brain :-) Ideally, it should be
    strategically positioned in the head of some human :-), looking at the IDS
    alerts and the "FPdb" data.

    When I mentioned database, I did NOT imply any automated processing of
    kind 'NIDS sees an alert and does an online lookup to FPdb'. The usage
    pattern is more likely to be 'I know I run Application X here and snort
    keeps flagging its traffic as Y Attack. What is going on? How can I
    research it? The person then goes and looks for "common false positives
    with Application X" as repoted by the community. He sees that this
    traffic was often reported as a FP and that guidelines are provided to
    tune the signature to avoid that.'

    The above usage scenatio makes the abuse possibility very low. Overall,
    the FPdb will serve to HELP with research rather than to REPLACE it.

    Best, 

    -- 
  Anton A. Chuvakin, Ph.D., GCI*
     http://www.chuvakin.org
   http://www.info-secure.org
---------------------------------------------------------------------------
Captus Networks IPS 4000
Intrusion Prevention and Traffic Shaping Technology to: 
 - Instantly Stop DoS/DDoS Attacks, Worms & Port Scans
 - Automatically Control P2P, IM and Spam Traffic
 - Precisely Define and Implement Network Security & Performance Policies
FREE Vulnerability Assessment Toolkit - WhitePapers - Live Demo 
http://www.securityfocus.com/sponsor/CaptusNetworks_focus-ids_000101
---------------------------------------------------------------------------
  • Next message: Keith W. McCammon: "Re: Multiple network segment monitor with Snort"

    Relevant Pages

    • Re: Embed Signature Command
      ... your database will grow extensively as you add more pictures to it. ... You could even create an upload signature ... WindowsUserName in that field instead. ... Dim lStringLength As Long ...
      (microsoft.public.access.formscoding)
    • Re: deleted undotbs01.dbf...
      ... (in fact Undo tablespace has to be backed up ... case you can open your database but when you select from a table you ... i've not the opportunity to talk with other in English and so my ... Lines after that are considered a signature, ...
      (comp.databases.oracle.server)
    • Re: signature based IDS/IPS effectiveness
      ... That depends greatly on the signature. ... For example, using snort it is possible to write a signature that checks first for the protocol, then the application, then the specific function and then the size of the data. ... can get superuser privileges or carry out DOS on database services. ... Mod_security is a good choice for apache, for example, and can stop db attacks before they even get to the web server ...
      (Focus-IDS)
    • Re: Electronic Forms software that integrates well with Access
      ... I have a client for whom I built a client database to replace and update ... electronic signature validation. ... Whatever the "authority" requiring the ...
      (comp.databases.ms-access)
    • Random IDS Thoughts [WAS: Re: IDS thoughts]
      ... Commodotization of the IDS space, in general: ... grepping" vs. "protocol inspection" debate of a year ago; almost all NIDS ... that simply did not "fire" right on some attacks. ... wasn't designed to test signature coverage ...
      (Focus-IDS)
    • Quantcast