Re: IDS with Case-Based Reasoning

From: Sanjay Rawat (sanjayr_at_intoto.com)
Date: 08/25/05

  • Next message: Daniel Cid: "RE: using HIDS for change control" 
    Date: Thu, 25 Aug 2005 10:43:24 +0530
To: Israel <israel@ditech.com.br>, focus-ids@securityfocus.com

    Hi Israel:
    This is Sanjay. Its nice to hear about your project, based on CBR. i will
    be happy to participate in discussion on points/problems, which you may
    face during the project. to my understanding, the main issue in CBR is to
    represent the known cases (in your case, attacks) in an effective manner. I
    find good theoretical papers, but less real-life implementations of CBR.
    Most of the applications are from medical side. There are couple of papers,
    suggesting the use of CBR in IDS (i dont remember the references at
    present, probably some googling will do that). which attack repository, are
    you going to use- DARPA?

    best wishes and regards
    Sanjay

    At 08:13 PM 8/24/2005, Israel wrote:

    >Hello,
    >
    >I'm developing a IDS project in my computer science graduation.
    >It will be use Case-Based Reasoning and handle a repository with the
    >malicious network log to generate responses.
    >The libpcap is used to capture a network trafic.
    >Have you suggestions to implementation?
    >The software is under GPL license and I would like to invite interested
    >peoples to program.
    >
    >Thanx
    >
    >Israel Rocha
    >
    >
    >------------------------------------------------------------------------
    >Test Your IDS
    >
    >Is your IDS deployed correctly?
    >Find out quickly and easily by testing it with real-world attacks from
    >CORE IMPACT.
    >Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    >to learn more.
    >------------------------------------------------------------------------
    >

    Sanjay Rawat
    Senior Software Engineer
    INTOTO Software (India) Private Limited
    Uma Plaza, Above HSBC Bank, Nagarjuna Hills
    PunjaGutta,Hyderabad 500082 | India
    Office: + 91 40 23358927/28 Extn 422
    Website : www.intoto.com
       Homepage: http://sanjay-rawat.tripod.com

    ------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it
    with real-world attacks from CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    ------------------------------------------------------------------------

  • Next message: Daniel Cid: "RE: using HIDS for change control"

    Relevant Pages

    • RE: interesting paper on testing sig-based IDS
      ... to evasion (the actual evasion techniques are not ... interesting paper on testing sig-based IDS ... The mutation engine applies one or more mutant operators to ... > Find out quickly and easily by testing it with real-world attacks from ...
      (Focus-IDS)
    • RE: IDS alerts / second - Correlation - Virtualization
      ... any IPS has to do IDS first. ... >assumes that your server is vulnerable against xyz and blocks it. ... >with real-world attacks from CORE IMPACT. ...
      (Focus-IDS)
    • RE: IDS event filtering
      ... The trick with IDS and SIM is to find an approach, ... Filtering is not only about yes and no, ... My experience shows that management report should include also a summary ... > Find out quickly and easily by testing it with real-world attacks from ...
      (Focus-IDS)
    • RE: Hi, I want to study IPS
      ... I think testing with dataset from place like Lincoln labs is still useful ... you will need data from real networks to test ... The lab data also will not provide any real test for an IDS beyond very ... Find out quickly and easily by testing it with real-world attacks from CORE ...
      (Focus-IDS)
    • Re: Firewalls (was Re: IDS evaluations procedures)
      ... aims of security vendors over the last few years has been minimising ... One of the reasons that the reputation of IDS suffered (and maybe why ... I suggest we drop IPS from the nomenclature. ... > with real-world attacks from CORE IMPACT. ...
      (Focus-IDS)