Anomaly Based Network IDS

From: Joe Dauncey (secdistlist_at_dauncey.net)
Date: 06/18/04

  • Next message: Drew Simonis: "Re: Anomaly Based Network IDS" 
    Date: Fri, 18 Jun 2004 14:09:08 +0100
To: focus-ids@securityfocus.com

    Hi,

    I am interested in views on anomaly-based Network IDS.

    A colleague has proposed that we look at using one, but I am not sure how advanced they are? If indeed any exist?

    I know that at least Enterasys Dragon NIDS claims to be anomaly based.

    I suppose my defintion of anomaly based is that it discovers attacks based on sampling and analysing the network traffic and identifying anomalies on the norm, rather than relying on a specific external signature to tell it what to look for.

    I'm thinking that this would really have to be incredibly sophisticated as it's going to vary for every network environemtn, and could potentially generate a lot of false positives.

    I'm especially interested in anything that would claim to be able to detect a worm attack (and even prevent it) without knowing about it already - i.e. through a signature.

    I know that there have been a few Host-based IDS that make this claim, but I'm looking for something that will look after a network infrastructure, rather than a subset of specific systems.

    Any thoughts or comments?

    Thanks,
    Joe 

    -- 
Joe Dauncey
---------------------------------------------------------------------------
---------------------------------------------------------------------------
  • Next message: Drew Simonis: "Re: Anomaly Based Network IDS"

    Relevant Pages

    • RE: IPS comparison
      ... >It might if your DNS server doesn't normally do this. ... and anomaly detection. ... analysis tool for network traffic, netflow, firewall logs, host logs, .etc, ... but anomaly detection is just that -- anomalies. ...
      (Focus-IDS)
    • RE: IPS comparison
      ... >- maybe one day, the hard drive crashes, and all the network starts ... > doing DNS requests to the backup DNS server which looks like some ... >traffic, netflow, firewall logs, host logs, .etc, but anomaly detection ... That's why having a NADS to prioritize these anomalies could save you ...
      (Focus-IDS)
    • RE: Neural Net based Host/Application Anomaly detection systems
      ... Interesting enough however, anomaly detection is ... >> behavior on their given network. ... >> base data set is one way to solve the problem. ... >> anomalies on one network would be completely ...
      (Focus-IDS)
    • Re: Anomaly Based Network IDS
      ... Subject: Anomaly Based Network IDS ... > the network traffic and identifying anomalies on the norm, rather than relying on a specific external ... They can detect attacks ...
      (Focus-IDS)
    • RE: Anomaly Based Network IDS
      ... > I am interested in views on anomaly-based Network IDS. ... out pretty quickly in detecting hacking and policy violations. ... These type IDSes know that and watch for things ...
      (Focus-IDS)
    • Quantcast