Re: How do behavioral/anomaly detection systems learn?

[Ravi <ravivsn () roc co in>]

Hi,
      Many of recent IDS/IPS systems support mainly three kinds of detection and
      protection. They are 
                 -- Pattern based
                 -- Traffic anomaly 
                 -- Protocol anomaly.

    iGateway-InlineIPS product from Intoto provides all of above detection methods.
   One thing which I liked in that product is their Manager. It displays comprehensive
    log information and provides a way to tune the rules from 'log' screens. 

    Rules can be tuned to have alerts generated based on packets/time, bytes/time,
    session/time and can be tuned with Time, apart from having 5 tuple parameters.
    Thereby, for a given host/server/network and during some periods of time, the traffic
     parameters can be tuned to generate alerts. 

    As part of protocol anomaly, many of IDS/IPS systems provide application intelligence
    to detect RFC and implementation anomalies. This is one of the best ways to detect
    buffer overflows. 

  Regards
  Ravi
  Rendezvous On Chip (I) Pvt Ltd
  INDIA
                




Sasha Romanosky wrote:

> Greetings, 
>
> In regards to "behavioral" or "anomaly" detection systems vs. pure
> signature-based detection systems, I'm trying to understand how these
> behavioral technologies differentiate "good" traffic from "bad" traffic.
> I don't want to get into which is better, because they both have their
> place, of course. What I'm trying to understand is how these behavioral
> systems work, or "learn". 
>
> I have seen that this technique is not unique to intrusion detection
> systems, but also appears in application firewalls (e.g. Teros) and
> email virus scanners (e.g. using bayesian filtering). 
>
> With some products, I see that you configure them with specific rules,
> tailored to your particular environment, and with other products, you
> just point it to the network and it creates a profile all by itself. 
>
> Does this simply amount to another form of signature system, just with
> more intelligent signatures? Or is it more complex than this?.
>
> Any references (whitepapers, archives, sites, etc) explaining this
> learning would be most appreciated.
>
>
> Cheers,
> Sasha Romanosky
>
>
> ---------------------------------------------------------------------------
> ---------------------------------------------------------------------------
>
>  




---------------------------------------------------------------------------
---------------------------------------------------------------------------