Identifing things that go Dump

[ajcblyth () glam ac uk (Comp)]

Greetings,

        -----Original Message-----
        From:   Ryan Permeh [SMTP:rrpermeh () rconnect com]
        Sent:   18 November 1999 16:56
        To:     Blyth A J C (Comp)
        Cc:     'Stefano Maifreni'; ids () uow edu au
        Subject:        Re: IDS: RE: IDS

        this is a great idea, but how do you define "normal" network
traffic?  and when
        do you define it?  what if an attack is in progress while network
traffic is
        being normalized?  i've thought about this for a while as a method
to stop spam
        messages, and defining "normal smtp traffic" is nearly impossible,
due to the
        effect that the spam attacks are already part of the "normal".  I
know IDS
        doesn't actively defeat spam, as of now, however, as a side note, it
could.
        Misuse is much harder to detect in nomilization.  Certainly, you can
set up
        traffic flow diagrams of legit traffic, but you may run into two
issues.  1. an
        attacker may skew your results at the time of your measurement, and
2. attacks
        can be made low key enough to appear as "normal" traffic on your
network.  are
        you going to notice if somone was gathering  infmormation from your
mail server
        if he was only using  connects to tcp 25 to fingerprint your server?
a single
        tcp connection can tell a lot about a system, and not set off
alarms.  anamoly
        and misuse detection needs to grow up before i think it can easily
be used as
        an IDS.

        [Blyth A J C (Comp)]  

        I agree with you that there is much work still to be done in the
area of IDS. One idea with regard to nromalization of traffic is to
construct a meta model of security data and then import all your data (log
Files) and normalize your meta data. So for example: one reasonable
assumtion is the all port 25 connections should result in mail being sent or
delivered to that machine. If you combine that mail logs and the network
logs, then you can identify when and where this has happened. 

        Another posibbility is to use pre-defined data such as the DARPA
data to normalize your network traffic.This will allow you to examine
patterns that fall outside of such data.

Regards

Andrew.