RE: IPS comparison

From: Joseph Hamm (jhamm_at_lancope.com)
Date: 08/30/05

  • Next message: Jason Wright: "Re: IPS technology question." 
    Date: Tue, 30 Aug 2005 13:33:35 -0400
To: "Stefano Zanero" <s.zanero@securenetwork.it>, "Daniel Cid" <danielcid@yahoo.com.br>, "Focus-Ids Mailing List" <focus-ids@securityfocus.com>

    >Fact is, anomaly detection is so rare that it's almost unexistant in
    the commercial products, except for limited forms
    >of "protocol anomaly detection" and for Arbor's peakflow technology.

    Not true! The only reason this space hasn't gotten as much attention
    over the last few years is cause everyone was busy buying signature IDS
    and now IPS solutions.

    Pure Network Anomaly Detection players:
    Arbor
    Lancope
    Mazu
    Q1 Labs
    (All of these have been around for several years despite the lack of
    industry attention to this space. Am I missing any new ones?)

    Also, for a recent article on network anomaly detection systems (NADS),
    check out this month's Information Security Magazine (cover story). The
    NADS space (this is only the latest acronym used to describe this group
    of products), is starting to get more attention and press coverage. You
    will also find some articles that call these products NBAD (Network
    Behavior Anomaly Detection) solutions.

    Many security companies can detect "anomalies" in some form. Almost
    every security vendor has the word "anomaly" in their marketing
    literature. You need to understand what they mean by an "anomaly" and
    how they detect them.

    "protocol anomaly detection" and "network anomaly detection" are two
    different things although detecting network anomalies can include
    protocol anomalies as well. An IPS is a point solution, usually has
    limited network visibility (unless you spend a fortune and deploy them
    everywhere), and can only perform protocol anomaly detection (from what
    I've seen). In order to have the best NADS, you need complete network
    visibility and an understanding of what is "normal" on your network.

    Rolling out NADS generally requires less appliances than IPS (read less
    cost) because one box can gather network info from multiple SPAN ports,
    network taps, or get NetFlow/sFlow feeds from remote routers/switches.

    Kind regards,
    Joe

    Joe Hamm, CISSP
    Senior Security Engineer
    Lancope, Inc.
    jhamm@lancope.com
    404.644.7227 (cell)
    770.225.6509 (fax)

    Lancope - Security through Network Intelligence(tm)
    StealthWatch(tm) by Lancope, a next-generation network security
    solution, delivers behavior-based intrusion detection, policy
    enforcement and insightful network analysis. Visit www.lancope.com.

    -----Original Message-----
    From: Stefano Zanero [mailto:s.zanero@securenetwork.it]
    Sent: Monday, August 29, 2005 6:01 PM
    To: Daniel Cid; Focus-Ids Mailing List
    Subject: Re: IPS comparison

    Daniel Cid wrote:
    > This "anomaly" detection will only detect 0-day exploits for known
    > vulnerabilities.

    A zero-day exploit is a curious marketing thing. You suddenly redefine a
    difficult problem (catching zero-days) as a rather simpler problem
    (create signatures that actually describe the vulnerability, which is
    what any signature worth your licensing cost should do).

    So, presto!, you can rush up and put out some rather nice marketing
    material on it.

    Fact is, anomaly detection is so rare that it's almost unexistant in the
    commercial products, except for limited forms of "protocol anomaly
    detection" and for Arbor's peakflow technology.

    Best,
    Stefano Zanero
    ---------------------------
    Secure Network S.r.l.
    www.securenetwork.it

    ------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it with real-world attacks from
    CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    ------------------------------------------------------------------------

    ------------------------------------------------------------------------
    Test Your IDS

    Is your IDS deployed correctly?
    Find out quickly and easily by testing it
    with real-world attacks from CORE IMPACT.
    Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
    to learn more.
    ------------------------------------------------------------------------

  • Next message: Jason Wright: "Re: IPS technology question."

    Relevant Pages

    • Re: Current state of Anomaly-based Intrusion Detection
      ... The "anomaly detection" technology that you find in successful products such ... statistics, learned traffic thresholds, and pattern recognition. ... NetFlow is a good source of flow data. ... > the fourth kind would be behavioral, where some metric of host or network ...
      (Focus-IDS)
    • Useful NADS
      ... understand how network anomaly detection has merit. ... Thus when a NADS fires off an alert about this ... the baseline, especially if the baseline has been tweaked and tuned to ...
      (Focus-IDS)
    • Re: IDS thoughts
      ... > network that learns more than connection/flow patterns. ... "Anomaly detection" isn't an architecture or implementation. ... signature detection systems as a coherent response to the scripted ... INTRUSION PREVENTION: READY FOR PRIME TIME? ...
      (Focus-IDS)
    • Re: Useful NADS
      ... in the network at once enables a unique observational ... What NADS technologies have you deployed and when? ... > understand how network anomaly detection has merit. ... baselining these networks is also rarely useful. ...
      (Focus-IDS)
    • Re: [Full-disclosure] emergent security properties
      ... Anomaly detection might be part of a broader category of knowledge-based approaches that work better at large scale. ... It's a long debate about when data mining works or is just marketing hype for putting more hay on the haystack. ... The open source approach to security believes that having many eyes on a vulnerability increases the likelihood of detecting and then creating a patch for the vulnerability. ...
      (Full-Disclosure)