GMail wrote:
protocols which involves grammar like PL/SQL. Using PL/SQL I can write same
query with different ways and different constructs that leads to different
query patterns.
You can do that with almost any type of attack. Attacks are polymorph,
and unless the signature can target a specific feature of the attack
which is unescapable and has no legal uses, misuse-based systems are
bound to fail or to need very complex normalizations to take place.
That's a well known problem with misuse detection, it's been known for
15 years at least :)
Stefano
------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it
with real-world attacks from CORE IMPACT.
Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw
to learn more.
------------------------------------------------------------------------
