IDS to effectively capture the intrusion, the invasion must have a strong database features, which, as the public security department must have a sound information base as offenders. However, IDS signature database are usually carried by relatively rigid, experience "Changing Faces" to the invasion, which often meet, strangers. Therefore, administrators need to learn how to create to meet the actual needs of the feature data model, so that changing the status quo! This article will feature the concept of invasion, species and how to create features introduced in the hope to help readers master the deal as soon as possible "change of face" approach.
1, characteristic (signature) of the basic concepts
The features of IDS is the kind of information that used to distinguish a model for data communications, usually divided into multiple, the following are some typical situations and Recognition:
Reserved IP address from the connection attempt: can check the IP header (IP header) to easily identify the source address.
Joint property with illegal TCP flag packets: TCP header by comparing the marks set with known joint property right and wrong tags to identify the differences.
Special virus containing information Email: Email by comparing each to the theme of information and pathological information to identify the subject of Email, or by searching the vicinity of a specific name to identify.
Query load attempt buffer overflow in the DNS: DNS domain through analysis and examination of the length of each field to identify the use of DNS domain buffer overflow attempt. There is another identification method are: the load in the search for "shell code to use" (exploit shellcode) the sequence of code combinations.
POP3 server by issuing the same command which led to thousands of DoS attacks: by tracking the records of the number of times a command sent straight to see if more than the preset limit, and alarm information.
Not registered to use files and directories under the command of the FTP server, file access attacks: by creating a model with status tracking feature to monitor the success of the FTP login dialog, found in non-verification is an order of intrusion attempts.
Can be seen from the above categories cover a wide range of features, a simple header field value, highly complex connection state tracking, with the extended protocol analysis. Leaf can Zhiqiu, this article will start with the simplest features, discussed in detail the function and development, customized approach.
Also note: different products have the features of IDS functions also vary. For example: Some network IDS system only allows very little data to customize existing features or characteristics of the preparation of necessary data, while others allow a wide range of customization features of the data or writing, or even a feature can be arbitrary; Some IDS systems only can check the headers, or to determine the load value, while others can get anywhere on any packet data.
Second, feature do?
This seems to be an answer to the obvious question: is characterized by detecting suspicious packet content is really "not necessary" as a model, or "bad elements cloning." IDS system itself with this important part of why the need to customize or write in simple terms? Is this: Perhaps you often see some familiar communications wandering on the network information flow, due to the characteristics of IDS database system expired or the communication of information is in itself not to attack or detect data, IDS system does not concern them, and then Your curiosity rises again to the data in these suspicious when issued by the police, want to capture them, look at them in the end where it comes from, what your dry, so the only way is to customize existing features of the database some configuration or the preparation of the new features of the data.
Degree of customization features can be rough or writing may be fine, depends entirely on the actual demand. Or occurred only to determine whether the abnormal behavior was not sure what the specific attack name, saving resources and time; or determine the specific means of attack or vulnerabilities use patterns, in order to gain more information. I feel that the former applies to leaders, who need specific things to use, plus micro-macro, the enemy should not even think stroll in! -
Recommended links:
cover your laptop lid with art NOTEBOOK skinsHot Stocks Head Invasion: With Input For The Stock Market FrenzyVector graphics on the description of SEVERAL conceptsevaluation Multimedia Creation ToolsUT Starcom Orders by the Indian IPTV operatorReport Communications ToolsFor you Flash ToolsMP4 To 3GPHow to promote sales WILL not dieSoftBrands, because Focusing so professionalWang Donglin Beijing scholar ChairmanMP4 to Flash3GPP ConverterComment Dictionaries EducationKaspersky: Vigilance Good At Disguising The "beauty" Release Device TrojanGIS work?
