signature based IDS/IPS effectiveness

From: GMail <mayur100@xxxxxxxxx>
Date: Wed, 09 Jan 2008 13:29:14 +0530

focus-ids,

How effective are signature based IDS/IPS systems on text based
protocols which involves grammar like PL/SQL. Using PL/SQL I can write same
query with different ways and different constructs that leads to different
query patterns. So does not that mean stateless signature based IDS/IPS
are useless for database servers, etc.

Best Regards,
Mayur

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------

Follow-Ups:
- Re: signature based IDS/IPS effectiveness
  - From: Jamie Riden
- Looking for feedback on anomaly-based IDS systems
  - From: Libershal, David M.
- Re: signature based IDS/IPS effectiveness
  - From: Stefano Zanero

References:
- RE: Preventing layer 3/4 evasions
  - From: Mike Barkett

Prev by Date: Re: VM of IPS/IDS solution
Next by Date: RE: VM of IPS/IDS solution
Previous by thread: RE: Preventing layer 3/4 evasions
Next by thread: Re: signature based IDS/IPS effectiveness
Index(es):
- Date
- Thread

Relevant Pages

Re: Automating Macro Responses
... So the records for the dates (which is the query calculation ... for the above thing to work you need two queries ... Count+ 1 FROM signature AS sig WHERE sig.sigdate < ...
(microsoft.public.access.queries)
Re: Automating Macro Responses
... So the records for the dates (which is the query calculation part) ... for the above thing to work you need two queries ... Count+ 1 FROM signature AS sig WHERE sig.sigdate < ...
(microsoft.public.access.queries)
Re: empty fields
... I figured it out how to get the results I want from the query kind of based ... a way to display what the signature field name is along with the data. ... Just wondering if it is possible to make the query (and report) look ... Jeff Boyce wrote: ...
(microsoft.public.access.queries)
Re: Anagrams
... (which is unique for each anagram) ... ## And instead of calculating the signature on the fly, ... ## simply open the query from Python or I can grab the SQL ... ## anagram set as column header. ...
(comp.lang.python)
Re: Anagrams
... (which is unique for each anagram) ... ## And instead of calculating the signature on the fly, ... ## simply open the query from Python or I can grab the SQL ... ## anagram set as column header. ...
(comp.lang.python)