IDS: RE: Snort signature packet generator

["adam.w.hogan" <adam.w.hogan () delphi com>]

There is a program to do just that: Snot [0].  But this strikes me as a very inaccurate way to train a neural network.  
You would be using purely crafted packets which may or may not appear as an actual attack would.  Snot is made to fill 
up snort logs, and the packets it creates are done purely to trip rules, not appear 100% valid.  Instead I would 
download exploits and scanners like Nessus and use actual attacks to train your neural net.

-Adam.

[0] http://www.stolenshoes.net/sniph/index.html

-----Original Message-----
From: Graeme Connell [mailto:gconnell () middlebury edu]
Sent: Friday, November 05, 2004 12:29 PM
To: focus-ids () securityfocus com
Subject: Snort signature packet generator


I'm attempting to train a neural network using snort, and I'm having
trouble getting a good number of "bad" packets, IE: those that snort
considers malicious.  Since a snort signature is really just a
definition of a subset of all possible packets, it seems like it should
be possible to create a packet that snort considers bad by filling in
packet fields based on a snort signature, then filling the rest of the
packet with random garbage.  Does anyone know if this type of program
has already been created, and if so, where could I find it?  Thanks.

                --Graeme Connell

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------


****************************************************************************************

Note: The information contained in this message may be privileged and confidential and thus protected from disclosure. 
If the reader of this message is not the intended recipient, or an employee or agent responsible for delivering this 
message to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this 
communication is strictly prohibited. If you have received this communication in error, please notify us immediately by 
replying to the message and deleting it from your computer. Thank you.

****************************************************************************************

--------------------------------------------------------------------------
Test Your IDS

Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------