Re: Local Mirror Prevention with IDS

[Kevin Johnson <kjohnson () secureideas net>]

On Fri, 2004-12-17 at 07:38, Dimitrios Patsos wrote:
> Hi!
>
> Can anybody provide some help on how can we prevent a user from making a
> local mirror of a web site by using both host & network IDS?
>
> Thank you in advance.

Hi-

I am not sure that this would be possible in any usable way.  Off the
top of my head, the only way I could see doing this would be to alert on
any one requesting a certain number of pages within a specific time. 
BUT I think this would have two problems.  The first is that people or
web crawlers using the site could trigger it.  Second, all that someone
would need to do is pause long enough between requests and you would not
be able to differentiate between them and another normal user.  

The problem is, that to view a web page, it HAS to be transfered to the
client.

If you can give some more detail about what you would like to
accomplish, maybe we can come up with a solution that will work for your
issue.

Kevin
-------------------
BASE Project Lead
http://sourceforge.net/projects/secureideas
http://base.secureideas.net
The next step in IDS analysis!

Attachment: signature.asc
Description: This is a digitally signed message part