This is exactly what our Sentinel-IC application does. It's based on snort
and we've written software wrappers to do exactly this thing. The truth is,
most of the attacks are automated. That's what our IDS reporting data
indicates.
Cheers,
Joshua Barnes - Director of Business Development
-----Original Message-----
From: listbounce@securityfocus.com [mailto:listbounce@securityfocus.com] On
Behalf Of Sanjay R
Sent: Sunday, May 20, 2007 5:55 AM
To: Focus-Ids Mailing List
Subject: automatic signature generation
Hi List:
There have been few studies to propose the automatic generation for misuse
based IDS, like snort (in fact, it is the hot area of research among IDS
researchers). Suddenly, it came into my mind, whether is it feasible to
generate (Good) signatures for all types of attack in an automatic way (in a
black-box environment, where we don't have the source-code of the vulnerable
application)? Perhaps, It is easy
(relatively) to automatically generate signature for flooding type of
attacks. The main cause of my doubt is the observation that it is not
feasible to generate attacks automatically. Usually, an attacker spend hours
to analyze the application and then write an exploit. We don't have any tool
that take, as an input, the application to be exploited, and gives us an
working exploit (of course, Metasploit helps us to create exploit).
Therefore, the early thought that comes into my mind is "creating an
automated signature generation tool is as difficult as creating an automated
attack generation tool". I would like to know your opinion on this.
-Sanjay
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE
IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=in
tro_sfw
to learn more.
------------------------------------------------------------------------
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to
http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
