Detect Anomalous Behavior
Detect attacks and intrusions by monitoring your network for abnormal traffic, regardless of the actual content.
Most NIDS monitor the
network for specific signatures of attacks and trigger alerts when
one is spotted on the network. Another means of detecting intrusions
is to generate a statistical baseline of the traffic on the network
and flag any traffic that doesn’t fit the
statistical norms. One intrusion detection system of this type is
Spade
(http://www.silicondefense.com/software/spice/).
Spade
, or the Statistical Anomaly Detection Engine, is
actually a modified version of Snort that extends its functionality
into the realm of anomaly-based intrusion detection. The
Spade
preprocessor uses Snort to monitor the
network and then constructs probability tables based on the traffic
that it sees. It then uses this table to generate an anomaly between
and 1 for each packet (i.e., 0 is a definite normal, and 1 is a
definite anomaly).
Installing Spade
is easy. Just download the
source distribution, unpack it, and change into the directory that it
created. Then type a command similar to this, which will patch your
Snort source code:
$ make SNORTBASE=../snort-2.0.5
Of course, if your Snort source tree isn’t at
../snort-2.0.5
, you’ll need to
specify a different path.
Now change to the directory containing the Snort source code, and
compile and install Snort as you normally would
[Hack #82]
.
Once you’ve done that, you’ll need
to configure Snort to use Spade ...
Get Network Security Hacks now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.