Juniper and ISS Protocol Anomaly Detection Evaluation

["Mike Youngs" <myoungs () glenergy com>]

Hello Everyone,
 
I am doing a network based intrusion detection and prevention system
evaluation, and have come across something I would like this groups
collective experience to give an opinion on.
 
For various reasons, we have settled on making a selection between the
Juniper IDP 600C and the ISS Proventia GX5008.  During our evaluation, we
have found that Juniper and ISS offer their protocol anomaly detection means
in much different ways.  What I would like to hear from this group is your
experience and insight with either product's protocol anomaly detection.  If
someone has insight and/or experience with both products, that will be that
much better.  I hope to find out if each vendor's protocol anomaly detection
features are essentially the same thing, or if one is superior over the other
and why, so I can make a more informed decision on this feature.
 
Another way to say it is, does "protocol anomaly detection" mean the same
thing to both vendors?  It appears that "attack pattern" means something
different to each vendor.  One considers in the actual string or pattern to
look for in a packet, and the other considers is it multiple events when
viewed as a whole could mean an attack on a system.
 
Any insight would be appreciated!  Thanks in advance,
 
Mike Youngs
Network Manager
Great Lakes Energy

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------