Re: Random IDS Thoughts [WAS: Re: IDS thoughts]

> The fact that most IDS products out there now look the same is based on
the
> fact that most companies out there (or the people running them, to be more

Applause :-)

> statistical-based IDS, ot anomaly-based IDS

Actually, they are not necessarily sinonyms, you know ? Anomaly based IDS could be, for instance, based on neural algorithms or other adaptive models.

> could be beaten by flooding a network with "anomalous" traffic

Rather naive. If you have a product that does not "adapt", this is obviously not a problem (i.e., you deploy it, you train it, then you "lock" it). Letting an algorithm learn by itself and still not get fooled by a semantic drift (this it one of the current names for the effect you described) is not an easy task, but it can be accomplished by following a scheme such as this: - get the new data
- check if the new data is "wrong", if it is, fire an alert and do NOT update
- if the new data is not "wrong", update the model to fit a little better on the new data

Obviously someone can still sneakily, bit by bit, subvert the training of the IDS. But it becomes a rather long attack ;-)

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

> Being notified of events as they occur takes less time, as you

In the hope that you won't actually be alerted, say, three times every ten minutes...

> So thinking about all that, I thought of designing a log-based IDS, or
LIDS
> for acronym fans.

That's actually already used for Linux Intrusion Detection System kernel patches :)

I will be looking at LogIDS: looks like a really nice work tough !

Stefano

Download the latest white paper "Intrusion Prevention: Myths, Challenges, and Requirements" at: http://www.securityfocus.com/IntruVert-focus-ids2