I am also in the process of implementing a NIDS in Linux, only I am attempting to make it proactive, more like an IPS. As far as your work is concerned, do take a look at snort. Installing it is a breeze ( atleast on FC2 and before that i was). It pushes packets onto mysql, so once installed, all you have to do is log into mysql and view all the tables you need. That should give you a pretty idea regarding what fields you need.
LIDS is also supposed to be good, but i haven't been able to lay my hands on a free machine which I can ruin yet! With regard to my task of making the system proactive, can some one give some pointers to me? Right now i have configured ssh as rsh, so remote execution is a breeze. I am controlling all traffic through a firewall, so that when snort sees as attack (say critical attack), i can have a script constantly parse the logs and block the offending IP at the firewall. Am thinking of doing this in bash/perl. Was wondering if there is someway to make another utility which will be able to put some kind of heuristics into snort, so that it can pick up unknown attacks as well (ie, attacks which are not there in its rules files). Presently I am planning to track a few parameters (say network scans, etc, or Tx/Rx rates for a host which is not meant to be seeing that kind of activity, etc, flood ping from a source, etc) and then link that with the firewall so that the attack doesnt propogate and the mahine can be isolated. Any pointers regarding how I should be going about all this, especially the detection of unknown attacks? danke! regards John Galt On Tue, 22 Feb 2005 12:19:16 -0500, [EMAIL PROTECTED] <[EMAIL PROTECTED]> wrote: > On Tue, 22 Feb 2005 09:36:21 GMT, preeth k said: > > > I am designing a Network Intrusion Detection System in Linux. I want to > > create > > a database of intrusion signatures using MySQL database. Can anyone please > > give an idea about what all fields I have to include, how to store packet > > payload, which pattern matching algorithm to use, etc. (Will Boyer-Moore > > algorithm be appropriate for pattern matching in IDS?) > > Welcome to Systems Analysis 101. ;) > > I'm sure somebody will provide a pointer to SNORT, which is a good and useful > tool. However, it sounds like you want to design your own, which means you > have to do your own design work. > > And you really need to do your requirements list *first*. For instance, the > exact fields you need to store in your MySQL database will depend on what > things > you do or don't think are important to track. Which pattern matching > algorithm > to use will depend on what you want to support - if all you want to do is > "compare for fixed text at a fixed offset", you can probably steal the code > from tcpdump that handles expressions like 'ip[0] & 0xf != 5' to catch packets > with IP options. If you want to handle full regular expressions at arbitrary > offsets, you'll need a more cabable library. > > So for the 'Boyer-Moore' question - it depends. Do you intend to support > features > that Boyer-Moore is fast/efficient at? If so, then it's probably appropriate. > If you're not offering those features, some other algorithm that's > smaller/faster > may be a better choice. You may even want a hybrid approach, where you use > Boyer-Moore if the signature can use it, and some other algorithm if the other > one is a better choice, chosen at runtime.... > > > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html > > > > _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
