On Jul 31, 2006, at 8:58 PM, SanjayR wrote:
Please read the first line as "Yes...its true that there are more
misuse based ID systems than the anomaly based. "
thanks
At 11:02 AM 7/28/2006, SanjayR wrote:
Yes...its true that there are more anomaly based ID systems than
the misuse based. One possible reason may be the rate of FPs for
anomaly based systems. If you look at the research perspective,
there is a big gap between the research and commercial ID systems.
Reason may be research is focusing on Machine learning, data mining
I can't agree with this statement - properly-implemented AD systems
don't exhibit false positives at all, the key is whether or non one -
cares- about the anomalies one's seeing (and that's where tuning
comes in). My operational experience with commercial anomaly-
detection systems on production networks over the last 5 years is
that they're extremely useful for SP and large enterprise opesec
teams in terms of detecting/classifying/tracing back DoS attacks,
worm outbreaks, and other forms of network behaviors which may not be
deemed security risks in and of themselves, but which are interesting
or of possible forensic value (i.e., user kicks off large ftp
transfer to a server he's never accessed before, etc.), and I've
never seen a false positive during that time.
There are several commercial AD systems (both statistical and
behavioral) which are quite good; there's also an open-source project
called Panoptis, but it's been inactive for a while.
----------------------------------------------------------------------
Roland Dobbins <rdobbins@cisco.com> // 408.527.6376 voice
Everything has been said. But nobody listens.
-- Roger Shattuck
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
------------------------------------------------------------------------
