Security Training
Security Certification
Cyber Security Graduate School
Internet Storm Center
Security Awareness Training
Computer Forensics
Penetration Testing
IT Audit
Software SecurityIntrusion Detection FAQ
The Internet's most trusted site for vendor neutral intrusion detection information.
Updated May 19, 2010
Click here for Intrusion Detection In-Depth: The Most Advanced Intrusion Detection Immersion Training Available
The Basics
- What is Intrusion Detection?
- How can I contribute to the FAQ?
- Books on or related to Intrusion Detection and Prevention
- Can I use a MAC Address in Intrusion Detection?
- I keep seeing network mapping attempts, should I be concerned?
- How is a tool like an integrity checker used in Intrusion Detection?
- What open standards exist for Intrusion Detection?
- How do you deploy network based Intrusion Detection Systems in a switched network?
- What is a Honeypot?
- What is a honeypot and how is it used?
- What is a honeypot? Why do I need one?
- Why should I not run a honeypot?
- If someone from a large organization called and asked you for advice on what he or she should do first to get started on Intrusion Detection, what one thing would you recommend?
- Should communication between the sensor (or agent) and the monitor be encrypted?
- Why is intrusion detection required in today's computing environment?
- Can the volume of network traffic get high enough to exceed the capability of the detectors?
- If hackers break into my network, how would the press ever find out and why would anybody else care?
- What is the risk to Windows 9x from Dedicated Internet Connections?
- Why your switched network isn't secure.
- What Do You Do After You Deploy the Intrusion Detection System?
- Are there limitations of Intrusion Signatures?
- What should I do to mitigate false positives?
- What are the differences between Network Intrusion Detection and Network Intrusion Prevention?
- What is a Host Intrusion Detection System?
- What is the Difference Between an IPS and a Web Application Firewall?
- What is the Difference Between an IPS and a Network Based Database Activity Monitor?
- Mapping Active Ports To Corresponding Processes
- What is Geolocation and How Does it Apply to Network Detection?
Terms, Theory and Research
- What is Intrusion Detection?
- What is host based Intrusion Detection?
- What is network based Intrusion Detection?
- What is a layered defense?
- What is knowledge based Intrusion Detection?
- What is behavior based Intrusion Detection?
- The Importance of Intrusion Detection
- What is a false positive and why are false positives a problem?
- What is a false negative?
- Why do I get so many false positives?
- What is a bastion host?
- A Taxonomy of Intrusion Detection Techniques
- What Do People Mean by Socks?
- Data Mining in Intrusion Detection
- Statistical based approach to Intrusion Detection
- Can you explain traffic analysis and anomaly detection?
- What is covert channel and what are some examples?
- How does Fragroute evade NIDS detection?
- What is polymorphic shell code and what can it do?
- Intrusion Detection System Evasion and Denial of Service Using RPC Design Flaws
- How does an attacker evade Intrusion Detection Systems with Session Splicing?
- Are there tools to visualize the data from an intrusion detection system?
- How to place Intrusion Detection System sensor in redundant networks?
- Intrusion detection on wireless network?
- What is Meta-Intrusion Detection Systems?
- Using Snort to Detect Clear Text Credit Card Numbers
Scanners and Scan Patterns
- What is nmap and what does it do?
- Can fragments help attackers evade detection?
- What was the Ring Zero scan?
- I am seeing odd ICMP traffic, what could this mean?
- Computer Associates RCO Option
- RPC and NMAP Patterns
- Port 1080 and 23, and IRC Server Signature
- What Do These PC Anywhere Reports Mean? (See: Paranoid PC Anywhere in the Information Security Reading Room for more information)
- Port 1600 Scan
- Port 137 Scan
- TCP/IP Stack Fingerprinting Principles
- Passive Fingerprinting Utilizing the Telnet Protocol Negotiation data
- How can attacker use ICMP for reconnaissance?
- What is p0f and what does it do?
- How can passive techniques be used to audit and discover network vulnerability?
- What is XProbe?
- Reconnaissance Techniques using Spoofed IP Addresses
- What is Remote Identification, Next Generation (RING)?
- What is AMap and how does it fingerprint applications?
- What is Scanrand?
Management and Legal Issues
- How do I get support from an ISP to investigate an incident?
- How do I convince my boss/manager/supervisor/board of directors to pay for an Intrusion Detection System (IDS)?
- How to make the business case for an Intrusion Detection System?
- Is port scanning legal?
- Should we outsource monitoring?
- What is MSSP (Managed Security Service Provider) and how can it help my organization?
Incident Handling and Response
- What are the steps to handle an incident?
- What do I have to do to preserve evidence?
- What was the Melissa virus and what can we learn from it?
- Who do I contact when I receive unusual traffic from a host?
- Preventing SYN Flooding with Cisco Routers
- What difficulties are associated on matching events with attacks. Why is event/data correlation important?
- Network Intrusion and use of automated responses
- What is Active Response?
- What is the Role of Security Event Correlation in Intrusion Detection?
- What is The Role of a SIEM in Detecting Events of Interest?
- Detecting Conficker with NMap
NT Specific Questions
- How do I do logging with NT?
- What is an NBT name?
- I ran netstat on my NT server and see all these active ports, how can I find out what they are for?
- Running Snort under Windows
- What Logging Would You Recommend for Windows
- What is an NBT (NetBIOS) Name?
Unix Specific Questions
- What are signs a Unix system is compromised?
- Do telnet and rlogin increase the risk of compromise?
- Is it really important to make sure the root account has a history file?
- Do I "really" need to install patches to my system? I don't run the services/products that patches were issued for.
- Is blocking port 111 sufficient to protect your systems from RPC attacks?
- I am seeing a PAM error message, what does it mean?
- How to Examine a Unix Box for Possible Compromise
- Knark: Linux Kernel Subversion
- Build Securely Snort with Sguil Sensor Step-by-Step Powered by Slackware Linux
Intrusion Detection Products
- How do I Tie the Identity of the Person Behind the Network Activity I Detect?
- What Are the Top Selling IDS/IPS and What Differentiates Them From Each Other?
- What are common attacker tools?
- Which backdoors live on which ports?
- Verifying Files with Red Hat's RPM
- Finding Listening Applications on Windows
- Why egress filtering benefits your organization
- Setting up a simple inexpensive ($39.95) host intrusion detection system.
- What are some emerging options for Network Intrusion Detection Systems?
- How to Evaluate Network Intrusion Detection Systems?
- Deploying Open Sourced Network Intrusion Detection for the Enterprise
Attack Examples
- Analysis of the Type0 (Class 0) DNS that has been detected, version 1.0
- Linux System Compromise
- A Look at Deep Throat
- Analysis of a fingerd replacement
- The "stacheldraht" Distributed Denial of Service Attack Tool
- Analysis of Rootkit/Smurf Payload Toolkit v 1.1
- The trouble with RPCs
- SubSeven Trojan v 2.1
- Analysis of N.F.O hacking- / rootkit
- Distributed Denial of Service Attack Tools: trinoo and wintrinoo
- Using SNMP for Reconnaissance
- Detecting Trojan Programs that Use Email to Remotely Monitor Victim Systems
- What is the TSIG vulnerability?
- The Zombie Scan of June/July 2001
- What are unicode vulnerabilities on Internet Information Server (IIS)?
- What is the Q Trojan?
- An analysis of SQL.Spider-B (Digispid.B.Worm, Spida, MSSQL Worm and SQLSnake)
Check Them Out!
I have 14 years experience in IT security, and SANS is by far the best technical security conferences I have attended.
-Tom Davis, Indiana University
