Collaborate Disseminate
We are building a packet based anomaly detection system and I’m trying to find labeled packets.
Such dataset doesn’t exist based on my search, but I can find labeled flows.
Can we say that every packet is hostile which is part of a flow th… Continue reading Is every packet of a hostile network flow hostile?
While perimeter defenses like firewalls and antivirus software remain essential elements of comprehensive network defense, stopping 100% of attacks at the perimeter is an impossibility with today’s ever-evolving attack surface. Eventually, an attacker… Continue reading 3 Keys to Defending Active Directory
I’m trying to create an anomaly detection based IDS using the CSE-CIC-IDS2018 dataset. I have selected features and created an anomaly detection model, but I don’t know how to convert the traffic to the CSE-CIC-IDS2018 data type.
I thought… Continue reading anomaly detection based IDS implementation [closed]
I’m getting into OWASP CRS with ModSecurity and was investigating the way OWASP calculate the anomaly score in the REQUEST-901-INITIALIZATION.conf they set the following lines:
setvar:’tx.anomaly_score=0′,\
setvar:’tx.anomaly_score_pl1=0′,… Continue reading OWASP CRS Anomaly scoring, ModSecurity WAF
I was going around when I saw a certain post about questions for SOC analysts. One of those questions (Q9) intrigues me:
What are some ways one can figure out of some encrypted incoming traffic carries malicious some paylo… Continue reading How to figure out if encrypted incoming traffic is malicious or benign?
I am doing a masters thesis on anomaly detection in cloud environment. So I came across this question what are the security mechanisms deployed by cloud service providers.
I want to know what should I search or read to und… Continue reading What are the security mechanisms deployed by existing Cloud service providers [on hold]
I am trying to write a manual for the intern on how to deal with some threats. What investigation steps could be done to detect Unusual Port Activity? What kind of logs could be found to ensure that there are unusual activiti… Continue reading how can i detect Unusual Port Activity [on hold]
Is there a difference between dynamic malware detection using automata and family behavior – graph?
I think that they are both relying on API function calls but I don’t understand if there is any major difference between the… Continue reading There is a difference between malware detection using automata and family behavior graph?
This question already has an answer here:
Help! My home PC has been infected by a virus! What do I do now?
10 answers
I h… Continue reading How to remove a very stealthy virus? [duplicate]
Should an application on Windows that has a DSL (domain specific language, scripting interpreter in this case) pass those scripts to AMSI for scanning, or should we restrict ourselves to more known types such as DLLs, Excel e… Continue reading AMSI scanning for domain specific languages