Chapter 11 Intrusion Detection System

More documents

Recommendations

Info

Anomaly <strong>Detection</strong> use a model of “normal” system behavior tries to detect deviations from this behavior, e.g., raise analarm when a statistically rate event occurs. can potentially detect new (not previously-encountered)attacks low false negative rate, high false positive rate Security Spring 2013
Ex. : Misuse vs. Anomaly <strong>Detection</strong> Password file modified Four failed login attempts Failed connection attempts on 50sequentially-numbered ports a SEU student log in http://jwc.seu.edu.cn at 4:30am from anIP address in Korea massive UDP packet to port 1434 ? ? ? ? ?Security Spring 2013
Page 3 and 4: Security Spring 2013Basic IDS conce
Page 5 and 6: Why Is Intrusion DetectionWhy is In
Page 7 and 8: Elements of Intrusion Detectionents
Page 9 and 10: Intrusion Detection Approaches Mode
Page 11 and 12: Measuring (Cont’d) True positive
Page 13 and 14: Example 70,000 events, 300 intrusio
Page 15 and 16: Bayesian Detection RateBayesian Det
Page 17 and 18: Misuse DetetionMisuse Detectionpatt
Page 19: Anomaly DetectionAnomaly Detectiona
Page 23 and 24: Signature Generation Research chall
Page 25 and 26: Examples of Metrics Count of number
Page 27 and 28: Where Is the IDS Deployedere Is the
Page 29 and 30: Host-Based IDS (Cont’d) Drawbacks
Page 31 and 32: File Integrity Checking Tripwire¡
Page 33 and 34: Some detailsSome Details• Anomaly
Page 35 and 36: Network-based IDS (Cont’d) Drawba
Page 37 and 38: Popular NIDS Snort¡ http://www.sno
Page 39 and 40: Snort Rule Syntax Each snort rule h
Page 41: Detecting Attack Strings Scanning f

Chapter 11 Intrusion Detection System

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?