Chapter 11 Intrusion Detection System

More documents

Recommendations

Info

Snort Rule Categories Backdoors Multimedia POP Telnet Chat MySQL RPC TFTP DDoS NETBIOS Scan Virus Finger NNTP Shellcode Web… FTP Oracle SMTP X<strong>11</strong> ICMP P2P SNMP IMAP SQL Security Spring 2013
Snort Rule Syntax Each snort rule has two logical sections:rule header and rule options¡ rule header contains action, protocol, source (IP address /port ),direction, destination (IP address/ port)¡ rule option contains alert messages, info on which parts of packet tobe inspectedSecurity Spring 2013
Page 3 and 4: Security Spring 2013Basic IDS conce
Page 5 and 6: Why Is Intrusion DetectionWhy is In
Page 7 and 8: Elements of Intrusion Detectionents
Page 9 and 10: Intrusion Detection Approaches Mode
Page 11 and 12: Measuring (Cont’d) True positive
Page 13 and 14: Example 70,000 events, 300 intrusio
Page 15 and 16: Bayesian Detection RateBayesian Det
Page 17 and 18: Misuse DetetionMisuse Detectionpatt
Page 19 and 20: Anomaly DetectionAnomaly Detectiona
Page 21 and 22: Ex. : Misuse vs. Anomaly Detection
Page 23 and 24: Signature Generation Research chall
Page 25 and 26: Examples of Metrics Count of number
Page 27 and 28: Where Is the IDS Deployedere Is the
Page 29 and 30: Host-Based IDS (Cont’d) Drawbacks
Page 31 and 32: File Integrity Checking Tripwire¡
Page 33 and 34: Some detailsSome Details• Anomaly
Page 35 and 36: Network-based IDS (Cont’d) Drawba
Page 37: Popular NIDS Snort¡ http://www.sno
Page 41: Detecting Attack Strings Scanning f

Chapter 11 Intrusion Detection System

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?