Re: IDS Signature Confidence

From: David W. Goodrum (dgoodrum_at_nfr.com)
Date: 06/21/05

  • Next message: Joel Esler: "Re: Vulnerability & Exploit Signatures" 
    Date: Mon, 20 Jun 2005 19:44:51 -0400
To: Raffael Marty <raffy@raffy.ch>

    Hi Raffael,

    at NFR we've recognized this, and with every alert we assign a
    "confidence index" to the alert. The index is a percentage of how
    "real" we think the attack is. In some cases, the index will be very
    high (for things that are known and can be mapped to a CVE or CAN), and
    for others it will be lower (some violation of a protocol anomaly), and
    for others it will be dynamic, depending on how much data we have. DoS
    attacks are typical of attacks where the more data you have, the higher
    the confidence might be.

    -dave 

    -- 
David W. Goodrum, CEH
Senior Systems Engineer
(nfr)(security)
http://www.nfr.com
See NFR Security at these upcoming events:
Security Ventures 2005, July 13, New York, NY
Raffael Marty wrote:
>I was thinking about this following problem: Assume you have an NIDS
>signature looking for DoS attacks. In most of the cases I don't trust the
>NIDS reporting on a DoS attack. A lot of the DoS sigs just look at
>some bytes on the wire and tell me that there is a DoS attack going
>on. However, I need some more evidence that my services are indeed not
>accessible anymore.  Some signatures on the other hand are very specific
>and you can trust them with whatever they report.
>Now this brings me to my question:  How do you guys decide how much
>confidence you put in a certain IDS signature? And I am not talking
>about prioritizing the event. I am talking about assigning a "success"
>or "possible success" to signatures.
>
>  -raffy
>
>
>--
>  Raffael Marty, GCIA, CISSP                     raffael.marty@arcsight.com
>  Senior Security Engineer                     Content Team @ ArcSight Inc.
>  5 Results Way             Cupertino, CA 95014              (408) 864-2662
>
>--------------------------------------------------------------------------
>Test Your IDS
>
>Is your IDS deployed correctly?
>Find out quickly and easily by testing it with real-world attacks from 
>CORE IMPACT.
>Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
>to learn more.
>--------------------------------------------------------------------------
>
>  
>
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------
  • Next message: Joel Esler: "Re: Vulnerability & Exploit Signatures"

    Relevant Pages

    • Re: DoS "Probing" on one of our hosts
      ... DoS attack duration can vary considerably. ... I've seen attacks that last ... 100 Mbit attacks might bring down a small ... huge packets which saturate your Internet connection and/or inbound ...
      (Incidents)
    • Re: OT: security flaw in Solaris and Trusted Solaris
      ... >>Solaris Flaw Leaves Machines Open to Attacks ... > well Andrew, VMS would have handled this a little differently ... ... Shows that Multinet and TCPware were vunerable to SSH ... BIND advisory includes a DOS attack. ...
      (comp.os.vms)
    • Blackice version 2.9 car - is this as effective as latest version? - PELASE help?
      ... Im running 2.9 car - which I understand is secure against the dos attack ... to prevent new attacks etc. ...
      (comp.security.firewalls)
    • RE: False Positives with IntruVert
      ... Subject: False Positives with IntruVert ... a different statement than IPS is not functional or not worth time or money. ... prevent attacks, ... profiled the attacks (signature or anomaly or combination of both)) has ...
      (Focus-IDS)
    • RE: IDS detection approaches
      ... Signature based analysis on TCP and UDP payload is no longer sufficient. ... Protocol Decoding combined with signature analysis is required to detect ... many recent attacks - such as SQL injection, XSS injection, RFE, LFI, buffer ... Subject: IDS detection approaches ...
      (Focus-IDS)