I'm not sure if it's feasible but it certainly sounds like the correct way to do things. From the firewall end, after the initial starting of allow all...deny bad... we moved to the much more secure of deny all...allow good function.
Our networks are all in the first stage still of allow all...deny bad. If you can generate rules for proper traffic and deny everything else; then you have the basis for moving to a deny all... allow good scenario for the network which would certainly cut down on the attack vectors. -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Sanjay R Sent: Sunday, May 20, 2007 6:55 AM To: Focus-Ids Mailing List Subject: automatic signature generation Hi List: There have been few studies to propose the automatic generation for misuse based IDS, like snort (in fact, it is the hot area of research among IDS researchers). Suddenly, it came into my mind, whether is it feasible to generate (Good) signatures for all types of attack in an automatic way (in a black-box environment, where we don't have the source-code of the vulnerable application)? Perhaps, It is easy (relatively) to automatically generate signature for flooding type of attacks. The main cause of my doubt is the observation that it is not feasible to generate attacks automatically. Usually, an attacker spend hours to analyze the application and then write an exploit. We don't have any tool that take, as an input, the application to be exploited, and gives us an working exploit (of course, Metasploit helps us to create exploit). Therefore, the early thought that comes into my mind is "creating an automated signature generation tool is as difficult as creating an automated attack generation tool". I would like to know your opinion on this. -Sanjay ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaig n=intro_sfw to learn more. ------------------------------------------------------------------------ ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
