Re: IDS and honeypots

[Niels Provos <provos () citi umich edu>]

On Wed, Apr 30, 2003 at 02:28:17PM +0200, rnoble wrote:
>    I'm investigating the idea of using the traffic captured by a honeypot
>    (in theory all data should be suspicious) and filtering out legal
>    traffic and traffic captured by existing misuse IDS signatures and
>    using the remainder to automatically create new signatures in order to
>    update IDS a IDS database
Look at

  http://niels.xtdnet.nl/honeyd/ch01-results/

Christian Kreibich's Honeycomb does something similar.

Niels.