Hi Raffy,
If a DoS attack is made up of valid traffic, then a NIDS signature isn't
going to pick it up.
You need to establish whether or not incoming traffic from individual IPs
meets acceptable transaction rates, and this is really a job for a
rate-based IPS.
Regards,
Tim
-----Original Message-----
From: Raffael Marty [mailto:raffy@raffy.ch]
Sent: 21 June 2005 00:00
To: focus-ids@lists.securityfocus.com
Subject: IDS Signature Confidence
I was thinking about this following problem: Assume you have an NIDS
signature looking for DoS attacks. In most of the cases I don't trust the
NIDS reporting on a DoS attack. A lot of the DoS sigs just look at
some bytes on the wire and tell me that there is a DoS attack going
on. However, I need some more evidence that my services are indeed not
accessible anymore. Some signatures on the other hand are very specific
and you can trust them with whatever they report.
Now this brings me to my question: How do you guys decide how much
confidence you put in a certain IDS signature? And I am not talking
about prioritizing the event. I am talking about assigning a "success"
or "possible success" to signatures.
-raffy
--
Raffael Marty, GCIA, CISSP raffael.marty@arcsight.com
Senior Security Engineer Content Team @ ArcSight Inc.
5 Results Way Cupertino, CA 95014 (408) 864-2662
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
