Re: IDS Signatures

[Valdis.Kletnieks () vt edu]

On Tue, 22 Feb 2005 09:36:21 GMT, preeth k said:

> I am designing a Network Intrusion Detection System in Linux. I want to create
> a database of intrusion signatures using MySQL database. Can anyone please
> give an idea about what all fields I have to include, how to store packet
> payload, which pattern matching algorithm to use, etc. (Will Boyer-Moore
> algorithm be appropriate for pattern matching in IDS?)

Welcome to Systems Analysis 101. ;)

I'm sure somebody will provide a pointer to SNORT, which is a good and useful
tool.  However, it sounds like you want to design your own, which means you
have to do your own design work.

And you really need to do your requirements list *first*.  For instance, the
exact fields you need to store in your MySQL database will depend on what things
you do or don't think are important to track.  Which pattern matching algorithm
to use will depend on what you want to support - if all you want to do is
"compare for fixed text at a fixed offset", you can probably steal the code
from tcpdump that handles expressions like 'ip[0] & 0xf != 5' to catch packets
with IP options.   If you want to handle full regular expressions at arbitrary
offsets, you'll need a more cabable library.

So for the 'Boyer-Moore' question - it depends.  Do you intend to support features
that Boyer-Moore is fast/efficient at?  If so, then it's probably appropriate.
If you're not offering those features, some other algorithm that's smaller/faster
may be a better choice.  You may even want a hybrid approach, where you use
Boyer-Moore if the signature can use it, and some other algorithm if the other
one is a better choice, chosen at runtime....

Attachment: _bin
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html