Re: signature based IDS/IPS effectiveness

[Stefano Zanero <s.zanero () securenetwork it>]

GMail wrote:

> protocols which involves grammar like PL/SQL. Using PL/SQL I can write same 
> query with different ways and different constructs that leads to different 
> query patterns. 

You can do that with almost any type of attack. Attacks are polymorph, 
and unless the signature can target a specific feature of the attack 
which is unescapable and has no legal uses, misuse-based systems are 
bound to fail or to need very complex normalizations to take place.

That's a well known problem with misuse detection, it's been known for 
15 years at least :)

Stefano

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------