full-disclosure - IDS Signatures

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <200502221719.j1MHJGDB021234@turing-police.cc.vt.edu>
From: Valdis.Kletnieks at vt.edu (Valdis.Kletnieks@...edu)
Subject: IDS Signatures 

On Tue, 22 Feb 2005 09:36:21 GMT, preeth k said:

> I am designing a Network Intrusion Detection System in Linux. I want to create
> a database of intrusion signatures using MySQL database. Can anyone please
> give an idea about what all fields I have to include, how to store packet
> payload, which pattern matching algorithm to use, etc. (Will Boyer-Moore
> algorithm be appropriate for pattern matching in IDS?)

Welcome to Systems Analysis 101. ;)

I'm sure somebody will provide a pointer to SNORT, which is a good and useful
tool.  However, it sounds like you want to design your own, which means you
have to do your own design work.

And you really need to do your requirements list *first*.  For instance, the
exact fields you need to store in your MySQL database will depend on what things
you do or don't think are important to track.  Which pattern matching algorithm
to use will depend on what you want to support - if all you want to do is
"compare for fixed text at a fixed offset", you can probably steal the code
from tcpdump that handles expressions like 'ip[0] & 0xf != 5' to catch packets
with IP options.   If you want to handle full regular expressions at arbitrary
offsets, you'll need a more cabable library.

So for the 'Boyer-Moore' question - it depends.  Do you intend to support features
that Boyer-Moore is fast/efficient at?  If so, then it's probably appropriate.
If you're not offering those features, some other algorithm that's smaller/faster
may be a better choice.  You may even want a hybrid approach, where you use
Boyer-Moore if the signature can use it, and some other algorithm if the other
one is a better choice, chosen at runtime....
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 226 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050222/ea168906/attachment.bin