Re: Bayesian IDS...help

[Pablo García Bringas <pgarcia () eside deusto es>]

Pablo García Bringas escribió:

   Here you can find the ESIDE-Depian prototype: 
http://ieeexplore.ieee.org/Xplore/login.jsp?url=/iel5/4312838/4312839/04312918.pdf?arnumber=4312918

   Regards,

         Pablo.

> Gleb Paharenko escribió:
>
>    Hi.
>
>    You can also try the SPICE/SPADE anomaly detector for TCP ip_dst, 
> ip_src, tcp_dst_port y tcp_src_port.
>
>    It builds a bayesian network of 4 nodes (the 4 previous parameters) 
> dinamically, considering the entropy of edges, using historical data.
>
>    Afterwards, it computes the conditional probabilities of the 
> tables, and then infer posterior probabilities of new packets.
>
>    I wouldn't forget the Snort IDS, and its regular expression 
> processor. You can also specify normal (and anomalous) behaviour using 
> previous knowledge.
>
>    Here you can find a paper of mine, describing our ESIDE-Depian IDS. 
> I hope it will be useful for you.
>
>    Agur.
>
>          Pablo.
>
> > Hi.
> >
> > Spamassasin uses bayasian for anomaly detection in mail. Perhaps you
> > can find there some useful things.
> >
> > 2008/1/31, Dinakara <om_dinu () indiatimes com>:
> >  
> > > Hi there,
> > >
> > >     I am working on Anomaly based Network IDS...
> > >     Statistical based technique is simple but not quite effective in 
> > > real
> > > scenario...
> > >     I understand Bayesian classifier/Network is  more effective in the
> > > context of anomaly detection,
> > >     but i have very little idea about Bayesian approach for IDS...
> > >     Can someone please help me out, i want to know  how to go about 
> > > it and
> > > if there are any open source
> > >     anomaly based tool available (bayesian IDS) ...
> > >
> > > Thanks in advance..
> > >
> > >
> > > --
> > > View this message in context: 
> > > http://www.nabble.com/Bayesian-IDS...help-tp15197689p15197689.html
> > > Sent from the IDS (Intrusion Detection System) mailing list archive 
> > > at Nabble.com.
> > >
> > >
> > > ------------------------------------------------------------------------ 
> > >
> > > Test Your IDS
> > >
> > > Is your IDS deployed correctly?
> > > Find out quickly and easily by testing it
> > > with real-world attacks from CORE IMPACT.
> > > Go to 
> > > http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
> > >
> > > to learn more.
> > > ------------------------------------------------------------------------ 
> > >
> > >
> > >
> > >     
> >
> >
> >   


------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw 
to learn more.
------------------------------------------------------------------------