RE: IDS Signature Confidence

[THolman () toplayer com]

Hi Raffy,

If a DoS attack is made up of valid traffic, then a NIDS signature isn't
going to pick it up.
You need to establish whether or not incoming traffic from individual IPs
meets acceptable transaction rates, and this is really a job for a
rate-based IPS.

Regards,

Tim

-----Original Message-----
From: Raffael Marty [mailto:raffy () raffy ch] 
Sent: 21 June 2005 00:00
To: focus-ids () lists securityfocus com
Subject: IDS Signature Confidence

I was thinking about this following problem: Assume you have an NIDS
signature looking for DoS attacks. In most of the cases I don't trust the
NIDS reporting on a DoS attack. A lot of the DoS sigs just look at
some bytes on the wire and tell me that there is a DoS attack going
on. However, I need some more evidence that my services are indeed not
accessible anymore.  Some signatures on the other hand are very specific
and you can trust them with whatever they report.
Now this brings me to my question:  How do you guys decide how much
confidence you put in a certain IDS signature? And I am not talking
about prioritizing the event. I am talking about assigning a "success"
or "possible success" to signatures.

  -raffy


--
  Raffael Marty, GCIA, CISSP                     raffael.marty () arcsight com
  Senior Security Engineer                     Content Team @ ArcSight Inc.
  5 Results Way             Cupertino, CA 95014              (408) 864-2662

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from 
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
--------------------------------------------------------------------------

------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it 
with real-world attacks from CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 
to learn more.
------------------------------------------------------------------------