El miÃ, 01 de 09 de 2004 a las 09:31, faisal99@inf.its-sby.edu escribiÃ:
Hai everyone,
sory if my question seems to be dummy question,
but I need several thing to know about anomalies detection for my college
assignment. Below are something to answer(if you don't mind)
1. To train the anomalies detection system, we must train the application
with the normal profile. My question is how we get the normal profile, are
they built by ourself or we try to get from our network dump data to be
set as normal profile or we use the prebuild data on the net(like the data
on the Lincoln Lab Data?)
I would say that the best way of getting the normal traffic from
our network it's to make it ourselves. I mean, you have to study
the network traffic and the use of the network your clients are
doing, having in mind what programs they use and what ports and
kinds of traffic they use to do. Then what I would do is to make
traffic with those same tools or programs and dump it to a file
with tcpdump. Then you can use tcpreplay to generate the "normal"
traffic for your network.
2. Is there any paper about SPADE(Snort Plugin), I've googling for
sometimes but never found one.
Spade it's now not under development and I don't know of any paper
about it. Sorry.
thnkyou, for the attention.
regards
Nafis Faisal
--
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac@bgsec.com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÃA
The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
-- Jack Kerouac, "On the Road"
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to
learn more.
--------------------------------------------------------------------------
