Khalats at 02:32, 24 March 2008

2008-03-24T02:32:32Z

← Older revision		Revision as of 02:32, 24 March 2008
Line 60:		Line 60:
	'''Alert'''		'''Alert'''

-	~~Alternation(1):~~	+	After a NIDS detects an attack. An Alert is given. Alerts can be generated on real-time or run-time basis.

-	- ~~warning at least~~	+	'''Reconfigure firewall'''
		+	Configure the firewall to filter out the IP address of the intruder. However, this still allows the intruder to attack from other addresses. Checkpoint firewall's support a "Suspicious Activity Monitoring Protocol (SAMP)" for configuring firewalls. Checkpoint has their "OPSEC" standard for re-configuring firewalls to block the offending IP address.

-	- or ~~some action taken against the IP that is attacking~~ you.	+	'''chime'''
		+	Beep or play a .WAV file. For example, you might hear a recording "You are under attack".

		+	'''SNMP Trap'''
		+	Send an SNMP Trap datagram to a management console like HP OpenView, Tivoli, Cabletron Spectrum, etc.

-	~~Alternation(2)~~	+	'''NT Event'''
		+	Send an event to the WinNT event log.

-	Symantec Host IDS provides real-time monitoring, detection, and prevention of security breaches, delivering automated policy enforcement and incident response for servers, applications, and data. As a complement to firewalls and other access controls, it enables administrators to develop proactive policies to stop hackers or authorized users with malicious intent from misusing systems.	+	'''syslog'''
-	New process management capabilities combine multiple intrusion prevention technology functions, including process reporting, monitoring, and blocking. Process Reporter provides access to granular process data so administrators can make rapid, informed decisions regarding server security. Process Monitor allows administrators to define a wide variety of security configurations to provide a fault-tolerant, secure environment. Process Blocker allows administrators to restrict server capabilities through defined policies to prevent malicious activity. These technologies provide an ~~efficient and non-intrusive intrusion protection solution~~ to ~~stop threats such as buffer overflow attacks~~.	+	Send an event to the UNIX syslog event system.

-	- ~~real time:~~	+	'''send e-mail'''
		+	Send e-mail to an administrator to notify of the attack.

-	~~best effort~~.	+	'''page'''
		+	Page (using normal pagers) the system administrator.

-	~~Data from~~ the ~~network layer~~.	+	'''Log the attack'''
		+	Save the attack information (timestamp, intruder IP address, victim IP address/port, protocol information).

-	~~Drop all~~ the packets ~~from a specific IP: so netfilter~~ for ~~that maybe dangerous. 'cause the pirate may have faked one of your internal IPs and then you are actually cutting of one of your local network connections~~.	+	'''Save evidence'''
		+	Save a tracefile of the raw packets for later analysis.

-	~~- run time:~~	+	'''Launch program'''
		+	Launch a separate program to handle the event.
		+
		+	'''Terminate the TCP session'''
		+	Forge a TCP FIN packet to force a connection to terminate.

Khalats at 02:21, 24 March 2008

2008-03-24T02:21:02Z

← Older revision		Revision as of 02:21, 24 March 2008
Line 19:		Line 19:

	----		----
-	'''	+
-	Detection	+	'''Detection'''
-	'''	+

	The typical function of a NIDS is based on a set of signatures, each describing one known intrusion		The typical function of a NIDS is based on a set of signatures, each describing one known intrusion

Network Intrusion Detection System - Revision history

Khalats at 02:32, 24 March 2008

Khalats at 02:21, 24 March 2008