Skip to Main Content
Network Security Hacks
book

Network Security Hacks

by Andrew Lockhart
April 2004
Intermediate to advanced content levelIntermediate to advanced
320 pages
9h 10m
English
O'Reilly Media, Inc.
Content preview from Network Security Hacks

Detect Anomalous Behavior

Detect attacks and intrusions by monitoring your network for abnormal traffic, regardless of the actual content.

Most NIDS monitor the network for specific signatures of attacks and trigger alerts when one is spotted on the network. Another means of detecting intrusions is to generate a statistical baseline of the traffic on the network and flag any traffic that doesn’t fit the statistical norms. One intrusion detection system of this type is Spade (http://www.silicondefense.com/software/spice/).

Spade, or the Statistical Anomaly Detection Engine, is actually a modified version of Snort that extends its functionality into the realm of anomaly-based intrusion detection. The Spade preprocessor uses Snort to monitor the network and then constructs probability tables based on the traffic that it sees. It then uses this table to generate an anomaly between and 1 for each packet (i.e., 0 is a definite normal, and 1 is a definite anomaly).

Installing Spade is easy. Just download the source distribution, unpack it, and change into the directory that it created. Then type a command similar to this, which will patch your Snort source code:

$ make SNORTBASE=../snort-2.0.5

Of course, if your Snort source tree isn’t at ../snort-2.0.5, you’ll need to specify a different path.

Now change to the directory containing the Snort source code, and compile and install Snort as you normally would [Hack #82] . Once you’ve done that, you’ll need to configure Snort to use Spade ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Linux: Powerful Server Administration

Linux: Powerful Server Administration

Uday Sawant, Oliver Pelz, Jonathan Hobson, William Leemans

Publisher Resources

ISBN: 0596006438Catalog PageErrata