Re: Email reputation for inout to IDSs?



Why would you want to do this on an ids? Al lot of email gateways have
a similar funktion (Sender base reputation filtering). I believe it
should be perfomed by the email gateway and not the ids/ips system. If
you want to do this on your ips I believe it will be overloaded or has
to be sized much bigger as normal.

Best regards

Bart Knippenberg

2008/11/23 Gautam Singaraju <gautam.singaraju@xxxxxxxxx>:
All,

I have been working in email reputation system that has computed
sender reputations for over an year. I believe that there are couple
of efforts to incorporate email reputations into IDSs. Is someone in
the group working on this? Are there any IDSs which can be configured
to perform extensive analysis for non-reputable senders? I would be
interested in sharing this data with other researchers in the group.

---
Gautam

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------



------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------