Re: question about anomalies detection

From: Jose Maria Lopez (jkerouac_at_bgsec.com)
Date: 09/08/04

  • Next message: Jose Maria Lopez: "Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?)" 
    To: "focus-ids@securityfocus.com" <focus-ids@securityfocus.com>
Date: 08 Sep 2004 19:25:50 +0200

    El mié, 01 de 09 de 2004 a las 09:31, faisal99@inf.its-sby.edu escribió:
    > Hai everyone,
    > sory if my question seems to be dummy question,
    > but I need several thing to know about anomalies detection for my college
    > assignment. Below are something to answer(if you don't mind)
    >
    > 1. To train the anomalies detection system, we must train the application
    > with the normal profile. My question is how we get the normal profile, are
    > they built by ourself or we try to get from our network dump data to be
    > set as normal profile or we use the prebuild data on the net(like the data
    > on the Lincoln Lab Data?)
    >

    I would say that the best way of getting the normal traffic from
    our network it's to make it ourselves. I mean, you have to study
    the network traffic and the use of the network your clients are
    doing, having in mind what programs they use and what ports and
    kinds of traffic they use to do. Then what I would do is to make
    traffic with those same tools or programs and dump it to a file
    with tcpdump. Then you can use tcpreplay to generate the "normal"
    traffic for your network.

    > 2. Is there any paper about SPADE(Snort Plugin), I've googling for
    > sometimes but never found one.
    >

    Spade it's now not under development and I don't know of any paper
    about it. Sorry.

    > thnkyou, for the attention.
    > regards
    >
    > Nafis Faisal 

    -- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA
The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------
  • Next message: Jose Maria Lopez: "Re: Firewall vs. IPS - Differences now (ISS, Intrushield 2.1?)"

    Relevant Pages

    • Re: question about anomalies detection
      ... To train the anomalies detection system, ... My question is how we get the normal profile, ... In an internal network they might be more useful. ... you could easily spot a worm trying to propagate through your network. ...
      (Focus-IDS)
    • Re: Proxy
      ... > we connect internet using broadband wireless connection. ... > there are about 500 client on the network we all connect to internet ... The only people for me are the mad ones -- the ones who are mad to live, ... the ones who never yawn or say a commonplace thing, but burn, burn, burn ...
      (comp.security.firewalls)
    • Re: Patch management tool
      ... If you need something more sophisticated, and useful for a network ... The only people for me are the mad ones -- the ones who are mad to live, ... the ones who never yawn or say a commonplace thing, but burn, burn, burn ... Ethical Hacking at the InfoSec Institute. ...
      (Pen-Test)
    • Re: Lisa daemon...
      ... > installing Lisa - type Konqueror. ... > al but it doesn't access the network. ... The only people for me are the mad ones -- the ones who are mad to live, ...
      (comp.os.linux.setup)
    • Re: How to access the address sucn as 10.0.0.225?
      ... The gateway has to provide routing from your network to the network ... The only people for me are the mad ones -- the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow Roman candles. ...
      (comp.os.linux.networking)