Re: Anamoly based network IDS

[Brian Hernacki <bhern () meer net>]

> Manhunt is actually a poor example.
>
> Manhunt focuses on validating protocols: it watches network traffic to
> see if it conforms to the official protocol specifications. If it
> doesn't conform (i.e. is invalid), then it triggers an event.

Actually Manhunt's protocol anomaly detection monitors for both protocol 
deviations and 'compliant but suspicious' protocol activity.

--brian





-----------------------------------------------------------
ALERT: Exploiting Web Applications- A Step-by-Step Attack Analysis
Learn why 70% of today's successful hacks involve Web Application
attacks such as: SQL Injection, XSS, Cookie Manipulation and Parameter 
Manipulation.
http://www.spidynamics.com/mktg/webappsecurity71