RE: question about anomalies detection

["Rob Shein" <shoten () starpower net>]

Actually, this is just signature-based IDS, where you're rolling your own
sigs.  If you were to do anomaly-based IDS, you'd more likely be doing the
logical inverse of this, where you would ignore the hostile traffic you
generated and defined the rest of it as "normal," and therefore you'd define
everything else as "suspicious."  The whole appeal of anomaly-based
detection is that it can theoretically notice attacks that nobody has ever
heard of before, simply because it differs from what is "normal."  And
therefore, it doesn't matter what attacks you generate, since it learns the
definition of "normal" rather than the definition of "hostile."

> -----Original Message-----
> From: Raj Malhotra [mailto:ral.mal () gmail com] 
> Sent: Friday, September 03, 2004 2:13 AM
> To: faisal99 () inf its-sby edu
> Cc: focus-ids () securityfocus com
> Subject: Re: question about anomalies detection
>
>
> Hi
>
> > 1. To train the anomalies detection system, we must train the 
> > application with the normal profile. My question is how we get the 
> > normal profile, are they built by ourself or we try to get from our 
> > network dump data to be set as normal profile or we use the 
> prebuild 
> > data on the net(like the data on the Lincoln Lab Data?)
>
> You can do all the three. But i would like to do it as follows:
> 1) assume that traffic on my LAN is clean.
> 2) set-up a machine running tcpdump with "-w" option to keep logging
>     what ever goes on the LAN.
> 3) use a linux box and run nmap with os finger printing 
> option on some target machines
>     on the same LAN.
> 4) the tcpdump will have a mixture of normal traffic and 
> scans for OS finger printing
>
> look for features that are unique to OS fingerprinting (read how nmap
> works) and try to use
>  k-nearest neighbour for classification.
>
> > 2. Is there any paper about SPADE(Snort Plugin), I've googling for 
> > sometimes but never found one.
>
> --------------------------------------------------------------
> ------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world 
> attacks from CORE IMPACT. Go to 
> http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_04
0708 to learn more.
--------------------------------------------------------------------------




--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------