Collaborate Disseminate
I’m starting a comparison paper about inline Network IPS. I was looking for an opensource anomaly-based detection engine with IPS capabilities. The easiest choice seemed Zeek(formerly Bro) but from the website user-manual it … Continue reading Can Zeek (formerly Bro) be installed as in-line IPS?
So I have a snort rule that detects syn flood attacks that looks like this:
alert tcp any any -> $HOME_NET 80 (msg:”SYN Flood – SSH”; flags:S;
flow: stateless; detection_filter: track by_dst, count 40, seconds 10;
GID:1; sid:10000002; … Continue reading Snort rule for syn flood attacks – Limiting number of alerts
I have a UniFi Security Gateway (USG Pro 4P) and just enabled IPS (intrusion prevention system). I am seeing many “ET POLICY PE EXE or DLL Windows file download HTTP” alerts. I have not been able to find any more information on that alert…. Continue reading intrusion prevention system detected "et policy pe exe" should i worry
I am trying to build a machine learning model which classifies attacks. My data has a bunch of IP addresses, and I don’t know if I should use the IP address as a feature to detect attacks. I found this interesting argument:
… Continue reading Can IP address considered as a useful feature for intrusion detection?
I saw a question a few days ago that talked about if a domain is bought by someone else then would the emails to that domain be compromised. And it got me thinking about google gsuite and specifically the use of the services … Continue reading Compromise Google GSuite by buying expired domain
Our LAN is configured behind a load balancing router, in turn connected to a modem assigning public IPs to connected devices.
I am required to randomly test the connection effective throughput, bypassing the load balancing r… Continue reading How to safely expose a computer to the Internet with a public IP
Is there a program for real time monitoring binaries` syscalls with gui interfaced policies deny or allow (so called intrusion detection) like was Systrace written by Niels Provos?
Systrase in examples: http://www.citi.umich… Continue reading Alternatives to Provos`es Systrace [on hold]
I have to choose a field to study on and I want to know does it worth studying in this field and will the future IDS/IPS systems be using machine-learning/deep-learning or at least how likely is it?
i heard that some compan… Continue reading How likely is it to see a commercial IDS/IPS that uses machine learning in the near future that performs better than a normal IDS/IPS? [on hold]
A friend of mine for which I manage the computer has presented me a problem.
How is it possible that Windows shows a random name in field “Authors” for a given document ?
Here is a bit of context:
The computer is not share… Continue reading Windows: Who is this randomname person that authored *my* LibreOffice document?
I am new to this forum, so apologies in advance if this question does not seem to fall within its scope, or if it seems too long:
On two occasions over the past ~3 weeks, a hacker gained remote access to my laptop (PC runni… Continue reading Does this evidence seem consistent with an intrusion via the VNC server?