Tomas,
The IDS on process monitoring seems interesting. Just wondering any
plan to generate the report based on IDMEF? The reports in the system
are generated using XML (report.xml?).
I am of an opinion that a common output format should be required for
all IDSs. This helps a lot when someone is interested in comparing
them with others.
thanks,
Gautam
On Tue, 19 Oct 2004 14:33:28 +0200 (CEST), Tomas Pluskal
<plusik@pohoda.cz> wrote:
Hello to all,
I have implemented a new type of intrusion detection system for my Master
thesis. I would like to announce this information, in case anyone would be
interested in this research.
The IDS system is designed as a kernel module for FreeBSD 5.2. It is inspired
by the SpamAssassin program, which detects spam by applying a set of tests to
every email message and counting a sum of point score generated by each test.
My IDS system applies a set of tests to every running process in the OS and
counts its score generated by the tests. Therefore, the purpose of the IDS is
not to monitor the network traffic, but rather to monitor the process
activity.
The current system status is a "working prototype" - it is not ready for
production usage, but it may serve as a good base for an interesting
research.
If you are interested in this topic, please read the details here:
http://plusik.pohoda.cz/thesis/
Thanks,
Tomas
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to
learn more.
--------------------------------------------------------------------------
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to
learn more.
--------------------------------------------------------------------------
