Re: question about anomalies detection

[Jose Maria Lopez <jkerouac () bgsec com>]

El mié, 01 de 09 de 2004 a las 09:31, faisal99 () inf its-sby edu escribió:
> Hai everyone,
> sory if my question seems to be dummy question,
> but I need several thing to know about anomalies detection for my college
> assignment. Below are something to answer(if you don't mind)
>
> 1. To train the anomalies detection system, we must train the application
> with the normal profile. My question is how we get the normal profile, are
> they built by ourself or we try to get from our network dump data to be
> set as normal profile or we use the prebuild data on the net(like the data
> on the Lincoln Lab Data?)

I would say that the best way of getting the normal traffic from
our network it's to make it ourselves. I mean, you have to study
the network traffic and the use of the network your clients are
doing, having in mind what programs they use and what ports and
kinds of traffic they use to do. Then what I would do is to make
traffic with those same tools or programs and dump it to a file
with tcpdump. Then you can use tcpreplay to generate the "normal"
traffic for your network.

> 2. Is there any paper about SPADE(Snort Plugin), I've googling for
> sometimes but never found one.

Spade it's now not under development and I don't know of any paper
about it. Sorry.

> thnkyou, for the attention.
> regards
>
> Nafis Faisal
-- 
Jose Maria Lopez Hernandez
Director Tecnico de bgSEC
jkerouac () bgsec com
bgSEC Seguridad y Consultoria de Sistemas Informaticos
http://www.bgsec.com
ESPAÑA

The only people for me are the mad ones -- the ones who are mad to live,
mad to talk, mad to be saved, desirous of everything at the same time,
the ones who never yawn or say a commonplace thing, but burn, burn, burn
like fabulous yellow Roman candles.
                -- Jack Kerouac, "On the Road"


--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more.
--------------------------------------------------------------------------