Stack Overflow
Stack Overflow

Questions tagged [intrusion-detection]

137 questions
0
votes
1 answer

Multi-threading in IDS

I have to develop an IDS for my college project. java code for the sniffer and the algorithm is available to me. I have to enable it to support 1 GB Ethernet traffic/sec. To do so we plan to incorporate multi-threading and run the code on a dual…
Asad Ikram
  • 61
  • 1
  • 1
  • 3
0
votes
1 answer

IDS/IPS functionality via Iptables rule

Does Iptables have IDS/IPS functionality? Linux: Ubuntu 12.04
Ahmet Karakaya
  • 9,899
  • 23
  • 86
  • 141
0
votes
1 answer

Understanding ossec and VMs: does a server perform an agent's work too?

So I have a mac host and some virtual machines. I want to use ossec to monitor my virtual machines and my host, mac OS X lion. (I've already fixed the compliation issue with lion, it compiled). See this I'm having trouble understanding what all the…
Adam Miller
  • 1,756
  • 1
  • 25
  • 44
0
votes
0 answers

Apache restarting itself and website is extremely slow

I have a problem with Apache web server restarting itself, my site is extremely slow on admin panel and FTP and I suspect my site might have been hacked. What are the best ways to see if my site was hacked and to find out who it was? And what best…
Finn Hanna
  • 1
-1
votes
1 answer

Implement Intrusion Prevention System from SNORT IDS

I have currently installed Snort 2.9.0.4 on Fedora 14 . The Snort IDS Mode is running perfectly, I want to Implement an IPS from the Snort IDS.. I am completely New to linux environment.
Naresh
  • 1
  • 2
-1
votes
1 answer

Determining the number of clusters for kdd99 dataset using k-means

What is the general convention for number of k, while performing k-means on KDD99 dataset? Three different papers I read have three completely different k (25,20 and 5). I would like to know the general opinion on this, like what should be the range…
BlueMango
  • 463
  • 7
  • 21
-1
votes
1 answer

Ossec nothing returned error

When searching in the Ossec server for the report, it is showing nothing returned (or search expired). What's this error?
Ashik Mohammed
  • 979
  • 1
  • 7
  • 9
-1
votes
1 answer

AWS Linux: illegal intrusion attempts against remote hosts on the Internet. Prevention methods?

I launched a linux instance and did the following. Only 22, 80 and 8080 ports were opened to "everywhere" as inbound rule Only git, ruby, ruby-dev, apache and youtrack was installed only from their original sources or using "yum install"…
user2271779
  • 5
  • 3
-1
votes
2 answers

New Dataset for creating rules for snort IDS

I am currently working on a project "Creating rules for network intrusion detection for snort IDS". snort IDS uses network packet header attributes(e.g. ttl,ip,etc.) for the rules. I am currently using KDD 1999 dataset for rule creation part. But,…
shrikrishna
  • 1
  • 2
-1
votes
1 answer

How can we train and test a neural network with UNB ISCX benchmark dataset?

I have tried with KDD dataset on my neural net and now I want to extend using ISCX dataset. Some part of this dataset contains the HTTP DOS attacks labelled represents replica of real time network traffic but I couldn't figure out how can I convert…
user3357263
  • 1
-1
votes
1 answer

FTP account being hacked but not damage done mystery story

My friend’s webserver has been hacked, but nothing was compromised. Here is my daily Sherlock Holmes story: My friend’s hosting provider sends an email that they 200ed all files on his server because they found compromising FTP log entries. My…
squeakingsneaker
  • 19
  • 2
-1
votes
1 answer

How to get TCP state of connection?

I use JPcap to capture packets. I don't know how to get TCP state of connection flags through these captured packet ? Ex: OTH, REJ, RSTO, RSTOS0, RSTR, S0, S1, S2, S3, SF, SH I am building Intrusion detection System.? At present extracting…
Son Vu
  • 19
  • 2
-1
votes
1 answer

Malicious Scripts found in asp.net solution explorer at Runtime

I have found some unknown .php files in Soultion Explorer of asp.net website while running locally. When ever i navigate between pages it dynamically created two files in the name of 1. eval code and 2. jsc3.js.php i understood this is malicious…
lollol
  • 95
  • 1
  • 2
  • 13
-2
votes
1 answer

convert http request to kdd cup data format with 41 parameters

machine learning is done using KDD cup dataset and formed a trained dataset.. Now I have to check the real time request with the trained dataset.. for that I have to convert TCP dump data/or http request to KDD CUP data set format(with 41…
ANAND SHULANOOR
  • 27
  • 4
-2
votes
1 answer

deploying intrusion prevention system with custom plugins (snort inline)

I have to deploy a Snort based intrusion prevention system. I am total newbie in this, so any kind of help , references for starters would be highly appreciated. Also snort documentation talks about Honeynet Snort Inline Toolkit, but the available…
Ashish Sharma
  • 1,124
  • 2
  • 24
  • 49
1 2 3
…
9
10