Re: IDS thoughts

["Stefano Zanero" <stefano.zanero () ieee org>]

I quote from two different e-mails:

> If we could properly model the data flows within an enterprise, then we
> could notice those flows that don't fit the model.

That's the entire idea of anomaly based IDS.

> Sometimes it is possible if you can enforce
> your model à la Bell-LaPadula and lattice models of information flow

Here you are talking about enforcement, not detection... as long as you can
enforce a rule, there's no need to resort to detection. Detection is useful
when you cannot state or enforce an a priori rule on something.

Here begins the other mail:

> challenge. In this context, it matters much less that a given approach
> is "anomaly-driven", and much more _which model_ is being used.

Not just which model, but also what variables are being fed into that model.

Also, I liked the passage on correlation and the importance of computer
science research in the field. I agree wholeheartedly.

Stefano



-------------------------------------------------------------------------------
INTRUSION PREVENTION: READY FOR PRIME TIME?

IntruShield now offers unprecedented Intrusion IntelligenceTM capabilities 
- including intrusion identification, relevancy, direction, impact and analysis 
- enabling a path to prevention.

Download the latest white paper "Intrusion Prevention: Myths, Challenges, and Requirements" at: 
http://www.securityfocus.com/IntruVert-focus-ids2
-------------------------------------------------------------------------------