Download presentation
Presentation is loading. Please wait.
1
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 1 2003-2004 Final Year Project Presentation DY1 Machine Learning for Computer Security Applications by Lam Ho-yu advised by Dr. Yeung Dit-yan
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_1.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude Final Year Project Presentation DY1 Machine Learning for Computer Security Applications by Lam Ho-yu advised by Dr. Yeung Dit-yan.")
2
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 2 What is computer security? Computer Security = Firewall? Is it secure? 7-eleven examples…
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_2.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 2 What is computer security. Computer Security = Firewall. Is it secure. 7-eleven examples….")
3
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 3 Intrusion Detection System (IDS) Real world: Surveillance Camera Computer Networks: IDS to monitor network This project: computer security application = Intrusion Detection System (IDS)
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_3.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 3 Intrusion Detection System (IDS) Real world: Surveillance Camera Computer Networks: IDS to monitor network This project: computer security application = Intrusion Detection System (IDS).")
4
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 4 Presentation Flow Problems of current IDS technology Objectives of this project Scenario – the key idea of this project System framework Another approach Active Support Vector Machine (ASVM) Active Support Vector Machine (ASVM)
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_4.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 4 Presentation Flow Problems of current IDS technology Objectives of this project Scenario – the key idea of this project System framework Another approach Active Support Vector Machine (ASVM) Active Support Vector Machine (ASVM).")
5
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 5 Problems of Current IDS Low-level Large Quantity False alerts – Password typo vs. Password guessing? Heavy workload for network security officers 172.16.113.50/portmap pm_getport: sadmind -> 0/udp 952442110.022445 SensitivePortmapperAccess rpc: 202.77.162.213/659 > 172.16.112.10/portmap pm_getport: sadmind -> 56255/udp 952442110.098242 SensitivePortmapperAccess rpc: 202.77.162.213/660 > 172.16.112.50/portmap pm_getport: sadmind -> 56261/udp 952443968.102596 ContentGap 194.27.251.21/13525 > 172.16.112.194/telnet content gap (< 92797/14296) A part of “alert.log” of Bro
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_5.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 5 Problems of Current IDS Low-level Large Quantity False alerts – Password typo vs. Password guessing. Heavy workload for network security officers /portmap pm_getport: sadmind -> 0/udp SensitivePortmapperAccess rpc: /659 > /portmap pm_getport: sadmind -> 56255/udp SensitivePortmapperAccess rpc: /660 > /portmap pm_getport: sadmind -> 56261/udp ContentGap /13525 > /telnet content gap (< 92797/14296) A part of alert.log of Bro.")
6
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 6 Objectives To allow easier separation between false alerts and real alerts To transform alerts to a more user-friendly representation To relief operator’s workload by automation
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_6.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 6 Objectives To allow easier separation between false alerts and real alerts To transform alerts to a more user-friendly representation To relief operator’s workload by automation.")
7
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 7 Notion of Scenario A typical attack usually takes several steps 1. Scan for candidate machines 2. Exploration – Gather information of the machine 3. Exploitation – Break into the machine 4. Escalation – gain more control (super-user) 5. Do anything the intruders want!! Operators want to see logical steps that the intruder is taking
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_7.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 7 Notion of Scenario A typical attack usually takes several steps 1. Scan for candidate machines 2. Exploration – Gather information of the machine 3. Exploitation – Break into the machine 4. Escalation – gain more control (super-user) 5. Do anything the intruders want!. Operators want to see logical steps that the intruder is taking.")
8
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 8 The System Framework
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_8.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 8 The System Framework.")
9
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 9 Learning Components Clustering – Group similar alerts together Correlation – Group alerts that are in the same scenario Multi-Layer PerceptronsDecision Tree
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_9.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 9 Learning Components Clustering – Group similar alerts together Correlation – Group alerts that are in the same scenario Multi-Layer PerceptronsDecision Tree.")
10
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 10 Key Results Total Clusters: 236 Alert count in clusters: 835 ***********************Correlation Results************************* Total Scenarios: 182 Alert count in Scenarios: 236 --------------- Confusion Matrix --------------- Processed Results DesiredTrueFalseTotal ------------------------------------------------------ True1261127 False130578708 ------------------------------------------------------ Total256579835 ------------------------------------------------------ Processed Results DesiredTrueFalseTotal ------------------------------------------------------ True99.21%0.7874%15.21% False18.36%81.64%84.79% ------------------------------------------------------ Total30.66%69.34%
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_10.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 10 Key Results Total Clusters: 236 Alert count in clusters: 835 ***********************Correlation Results************************* Total Scenarios: 182 Alert count in Scenarios: Confusion Matrix Processed Results DesiredTrueFalseTotal True False Total Processed Results DesiredTrueFalseTotal True99.21%0.7874%15.21% False18.36%81.64%84.79% Total30.66%69.34%.")
11
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 11 Screen Shot
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_11.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 11 Screen Shot.")
12
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 12
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_12.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 12.")
13
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 13 Q & A
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_13.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 13 Q & A.")
14
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 14 Thank you!
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_14.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 14 Thank you!.")
15
************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: http://www.whitehats.com/info/IDS08 * * Creation time: 0xc39e21e6.0x5b14b00 (2004-01-01 12:34:46.355+0800) * Detection time: 0xbc6f91f9.0x2202900 (2000-03-07 22:34:33.132+0800) * Analyzer ID: 1124004886740625120 * Analyzer model: Prelude NIDS * Analyzer version: 0.8.6 * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team http://www.prelude- ids.org * Analyzer OS type: Linux * Analyzer OS version: 2.4.18-27.8.0 * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: 172.16.112.50 * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: 194.7.248.153 * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: 172.16.112.50 -> 194.7.248.153 [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq=1733573269,ack=464246126,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd 24........#..'..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: prelude-devel@prelude-ids.org * Detection Plugin Description: Snort signature parser. * Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 15 Active Support Vector Machine Identify the “most useful” test data and ask the user to classify it for training Most useful? Random sampling Random sampling SVM-based sampling SVM-based sampling False Alerts True Alerts margin Test data
![************************************************************** ****************** * Alert: ident=2635 * Classification type: unknown * Classification: TELNET access * Classification URL: * * Creation time: 0xc39e21e6.0x5b14b00 ( :34: ) * Detection time: 0xbc6f91f9.0x ( :34: ) * Analyzer ID: * Analyzer model: Prelude NIDS * Analyzer version: * Analyzer class: NIDS * Analyzer manufacturer: The Prelude Team ids.org * Analyzer OS type: Linux * Analyzer OS version: * Node[unknown]: * Process: pid=1291 name=prelude-nids * * Impact severity: low * Impact completion: NULL * Impact type: other * Impact description: Not Suspicious Traffic * *** Source information ******************************************************** * Source spoofed: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=23 (telnet) protocol=tcp * *** Target information ******************************************************** * Target decoy: unknown * Node[unknown]: * Addr[ipv4-addr]: * Service: port=4221 protocol=tcp * *** Additional data within the alert ****************************************** * Ethernet header: 0:50:da:b7:6:88 -> 0:10:7b:38:46:3b [ether_type=ip (2048)] * Ip header: > [hl=20,version=4,tos=0,len=55,id=32892,ttl=64,prot=6,frag=[DF ]] * Tcp header: 23 -> 4221 [flags=PUSH ACK,seq= ,ack= ,win=33580] * Payload header: size=15 bytes * Payload Hexadecimal Dump: ff fd 18 ff fd 1f ff fd 23 ff fd 27 ff fd #.. ..$ * Detection Plugin Name: SnortRules * Detection Plugin Author: The Prelude Team * Detection Plugin Contact: * Detection Plugin Description: Snort signature parser.](http://images.slideplayer.com./16/4923620/slides/slide_15.jpg "* Snort rule ID: 716 * Snort rule revision: 5 * ************************************************************** ****************** Figure An alert of Prelude 15 Active Support Vector Machine Identify the most useful test data and ask the user to classify it for training Most useful. Random sampling Random sampling SVM-based sampling SVM-based sampling False Alerts True Alerts margin Test data.")
Similar presentations
