Re: anomaly vs signature

["Michael Vergoz" <mv () binarysec com>]

Indeed, categorization can be done between anomaly based vs signature based. 
that's a traditional approach, a complementary one is white list (everything 
not recognized is not allowed) or black list (i only stop what i know to be 
suspicious -signature, protocol anomaly, ...-, the rest is accepted). This 
second approach is from our point of view less efficient and much more 
resource consuming. I would like to suggest you  test (and give your 
feedback !) on our beta test product : http://www.binarysec.com which is a 
web firewall to be installed on an apache server (with linux), it uses an 
artificial intelligence engine. everything is software (1 Apache module + 1 
server).

Michael Vergoz

----- Original Message ----- 
From: "Roland Dobbins" <rdobbins () cisco com>
To: <focus-ids () securityfocus com>
Sent: Wednesday, August 02, 2006 5:53 PM
Subject: Re: anomaly vs signature


> On Jul 31, 2006, at 8:58 PM, SanjayR wrote:
>
> > Please read the first line as "Yes...its true that there are more  misuse 
> > based ID systems than the anomaly based. "
> > thanks
> > At 11:02 AM 7/28/2006, SanjayR wrote:
> > > Yes...its true that there are more anomaly based ID systems than  the 
> > > misuse based. One possible reason may be the rate of FPs for  anomaly 
> > > based systems. If you look at the research perspective,  there is a big 
> > > gap between the research and commercial ID systems.  Reason may be 
> > > research is focusing on Machine learning, data mining
>
> I can't agree with this statement - properly-implemented AD systems  don't 
> exhibit false positives at all, the key is whether or non one - cares- 
> about the anomalies one's seeing (and that's where tuning  comes in).  My 
> operational experience with commercial anomaly- detection systems on 
> production networks over the last 5 years is  that they're extremely 
> useful for SP and large enterprise opesec  teams in terms of 
> detecting/classifying/tracing back DoS attacks,  worm outbreaks, and other 
> forms of network behaviors which may not be  deemed security risks in and 
> of themselves, but which are interesting  or of possible forensic value 
> (i.e., user kicks off large ftp  transfer to a server he's never accessed 
> before, etc.), and I've  never seen a false positive during that time.
>
> There are several commercial AD systems (both statistical and  behavioral) 
> which are quite good; there's also an open-source project  called 
> Panoptis, but it's been inactive for a while.
>
> ----------------------------------------------------------------------
> Roland Dobbins <rdobbins () cisco com> // 408.527.6376 voice
>
>      Everything has been said.  But nobody listens.
>
>                    -- Roger Shattuck
>
>
>
>
> ------------------------------------------------------------------------
> Test Your IDS
>
> Is your IDS deployed correctly?
> Find out quickly and easily by testing it with real-world attacks from 
> CORE IMPACT.
> Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
> to learn more.
> ------------------------------------------------------------------------


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------