Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: IDS Signatures
From: John Galt <everbeeninlove () gmail com>
Date: Thu, 24 Feb 2005 22:33:07 +0530

I am also in the process of implementing a NIDS in Linux, only I am
attempting to make it proactive, more like an IPS. As far as your work
is concerned, do take a look at snort. Installing it is a breeze (
atleast on FC2 and before that i was). It pushes packets onto mysql,
so once installed, all you have to do is log into mysql and view all
the tables you need. That should give you a pretty idea regarding what
fields you need.

LIDS is also supposed to be good, but i haven't been able to lay my
hands on a free machine which I can ruin yet!

With regard to my task of making the system proactive, can some one
give some pointers to me? Right now i have configured ssh as rsh, so
remote execution is a breeze. I am controlling all traffic through a
firewall, so that when snort sees as attack (say critical attack), i
can have a script constantly parse the logs and block the offending IP
at the firewall. Am thinking of doing this in bash/perl. Was wondering
if there is someway to make another utility which will be able to put
some kind of heuristics into snort, so that it can pick up unknown
attacks as well (ie, attacks which are not there in its rules files).
Presently I am planning to track a few parameters (say network scans,
etc, or Tx/Rx rates for a host which is not meant to be seeing that
kind of activity, etc, flood ping from a source, etc) and then link
that with the firewall so that the attack doesnt propogate and the
mahine can be isolated. Any pointers regarding how I should be going
about all this, especially the detection of unknown attacks?



John Galt

On Tue, 22 Feb 2005 12:19:16 -0500, Valdis.Kletnieks () vt edu
<Valdis.Kletnieks () vt edu> wrote:
On Tue, 22 Feb 2005 09:36:21 GMT, preeth k said:

I am designing a Network Intrusion Detection System in Linux. I want to create
a database of intrusion signatures using MySQL database. Can anyone please
give an idea about what all fields I have to include, how to store packet
payload, which pattern matching algorithm to use, etc. (Will Boyer-Moore
algorithm be appropriate for pattern matching in IDS?)

Welcome to Systems Analysis 101. ;)

I'm sure somebody will provide a pointer to SNORT, which is a good and useful
tool.  However, it sounds like you want to design your own, which means you
have to do your own design work.

And you really need to do your requirements list *first*.  For instance, the
exact fields you need to store in your MySQL database will depend on what things
you do or don't think are important to track.  Which pattern matching algorithm
to use will depend on what you want to support - if all you want to do is
"compare for fixed text at a fixed offset", you can probably steal the code
from tcpdump that handles expressions like 'ip[0] & 0xf != 5' to catch packets
with IP options.   If you want to handle full regular expressions at arbitrary
offsets, you'll need a more cabable library.

So for the 'Boyer-Moore' question - it depends.  Do you intend to support features
that Boyer-Moore is fast/efficient at?  If so, then it's probably appropriate.
If you're not offering those features, some other algorithm that's smaller/faster
may be a better choice.  You may even want a hybrid approach, where you use
Boyer-Moore if the signature can use it, and some other algorithm if the other
one is a better choice, chosen at runtime....

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]