RE: Current state of Anomaly-based Intrusion Detection

["Orit Vidas" <orit () securimine com>]

Goran,
I would like to refer you to an interesting white paper about 'Baseline
Analysis of Security Data'. You can fine it in security docs.

In a nutshell, the approach is that anomalies should not be identified
at the raw data level, but should be searched for in the security alerts
themselves. The reason is two folded: a) the raw data is simply too much
to perform non-local analysis, and b) working with the raw data loses
all the security context of the incident (signature description, how to
and what to do advises, relevant patches, etc.).

Orit Vidas
orit () securimine com

-----Original Message-----
From: Göran Sandahl [mailto:goran () gsandahl net] 
Sent: Friday, February 25, 2005 4:05 PM
To: focus-ids () lists securityfocus com
Subject: Current state of Anomaly-based Intrusion Detection

Hi all.

I'm trying to get a picture of the current state of Anomaly-based 
network-monitoring-systems. In other words, Anomaly-based IDSs (are they

really called ADSs?). 
After following the thread "Specification-based Anomaly Detection", I've

realised that this question probably has allot of answers. However, I'd
be 
very glad if you would take the time and write a couple of lines on what
you 
think of the techniques that are used today, and whats needed for the
future. 
I'm interested in "both sides of the story", so please tense your
muscles and 
raise your voice ;)

As i figured, there are two different techniques that these systems work
upon. 
Either, they are based on specifications (for example, hardcoded 200kb/s

SMTP-traffic is normal) , or on statistic (Based on an "average". For 
example, 20 current TCP-sessions is normal). How does these techniques
really 
work? How are they implemented today? How is this statistical
information 
usually gathered? 

Also, signature-based IDSs are vulnerable to false alerts of different
kinds 
(postitive, negative etc). I can imagine that anomaly-based techniques
might 
suffer even worse to this. True?

And finally, while "reading through the lines" on some of the posts to
the 
thread mentioned above, I got a feeling that this technique isn't yet
ready 
for prime-time yet. Why is this? As I figure, the whole idea with
network 
intrusion detection is pretty new, and none of the techniques seems to
be 
without flaws.

Thanks in advance
Cheers
Göran

-- 
Göran Sandahl
mail:        goran () gsandahl net
web:         http://gsandahl.net

------------------------------------------------------------------------
--
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708

to learn more.
------------------------------------------------------------------------
--


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------