Re: IDS Signatures

[John Galt <everbeeninlove () gmail com>]

I am also in the process of implementing a NIDS in Linux, only I am
attempting to make it proactive, more like an IPS. As far as your work
is concerned, do take a look at snort. Installing it is a breeze (
atleast on FC2 and before that i was). It pushes packets onto mysql,
so once installed, all you have to do is log into mysql and view all
the tables you need. That should give you a pretty idea regarding what
fields you need.

LIDS is also supposed to be good, but i haven't been able to lay my
hands on a free machine which I can ruin yet!

With regard to my task of making the system proactive, can some one
give some pointers to me? Right now i have configured ssh as rsh, so
remote execution is a breeze. I am controlling all traffic through a
firewall, so that when snort sees as attack (say critical attack), i
can have a script constantly parse the logs and block the offending IP
at the firewall. Am thinking of doing this in bash/perl. Was wondering
if there is someway to make another utility which will be able to put
some kind of heuristics into snort, so that it can pick up unknown
attacks as well (ie, attacks which are not there in its rules files).
Presently I am planning to track a few parameters (say network scans,
etc, or Tx/Rx rates for a host which is not meant to be seeing that
kind of activity, etc, flood ping from a source, etc) and then link
that with the firewall so that the attack doesnt propogate and the
mahine can be isolated. Any pointers regarding how I should be going
about all this, especially the detection of unknown attacks?

danke!

regards

John Galt


On Tue, 22 Feb 2005 12:19:16 -0500, Valdis.Kletnieks () vt edu
<Valdis.Kletnieks () vt edu> wrote:
> On Tue, 22 Feb 2005 09:36:21 GMT, preeth k said:
>
> > I am designing a Network Intrusion Detection System in Linux. I want to create
> > a database of intrusion signatures using MySQL database. Can anyone please
> > give an idea about what all fields I have to include, how to store packet
> > payload, which pattern matching algorithm to use, etc. (Will Boyer-Moore
> > algorithm be appropriate for pattern matching in IDS?)
>
> Welcome to Systems Analysis 101. ;)
>
> I'm sure somebody will provide a pointer to SNORT, which is a good and useful
> tool.  However, it sounds like you want to design your own, which means you
> have to do your own design work.
>
> And you really need to do your requirements list *first*.  For instance, the
> exact fields you need to store in your MySQL database will depend on what things
> you do or don't think are important to track.  Which pattern matching algorithm
> to use will depend on what you want to support - if all you want to do is
> "compare for fixed text at a fixed offset", you can probably steal the code
> from tcpdump that handles expressions like 'ip[0] & 0xf != 5' to catch packets
> with IP options.   If you want to handle full regular expressions at arbitrary
> offsets, you'll need a more cabable library.
>
> So for the 'Boyer-Moore' question - it depends.  Do you intend to support features
> that Boyer-Moore is fast/efficient at?  If so, then it's probably appropriate.
> If you're not offering those features, some other algorithm that's smaller/faster
> may be a better choice.  You may even want a hybrid approach, where you use
> Boyer-Moore if the signature can use it, and some other algorithm if the other
> one is a better choice, chosen at runtime....
>
>
> _______________________________________________
> Full-Disclosure - We believe in it.
> Charter: http://lists.netsys.com/full-disclosure-charter.html
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html