preview

Bro Policy Assignment

Good Essays
Open Document

Using the policy scripts/analysers, ASCII text logs, which relate to the applications, are generated (http.log for HTTP traffic, ftp.log for FTP traffic, and so on). These logs tell an operator that problematic events have occurred, such as potential attempts to exploit a vulnerable service, malformed but not necessarily malicious traffic, new services starting that should not be running, or users violating a corporate policy, for example, by using instant messaging (IM). Bro has two different types of event handlers for information notification that might interest the operator/analyst. The notice function handles everything from errors to engine messages to notification of potentially bad information. By default, a notice is stored in the …show more content…

The major drawback of this approach, however, is that scanning network traffic running on all ports dramatically increases the processing load on the IDS, which easily leads to an underpowered system dropping packets and missing potential attacks. This approach will not be viable on a low powered single board computer as we intend to use. However, both IDS approaches do some form of protocol parsing to give to the analysts the ability to finely control what they want to search for when examining a given protocol. Bro IDS includes a facility to perform signature-based detection and a tool called snort2bro that converts Snort signatures to Bro IDS signatures. Same, Snort IDS signatures can be written to search for anomalous traffic on a given network. However, this capability is limited by which “stream” based interpreter the signature system can understand when finding anomalous traffic. Both Snort and Bro also contain mechanisms to deal with multistage attacks. Snort’s detection in this area is primarily stream-oriented: through the use of its flow bits keyword, Snort can tag a given TCP stream or even a UDP pseudo-stream (an active UDP conversation as having had part of the components necessary for a successful attack without actually generating an alert). In such a case, a second or third rule then becomes active on the stream in question, which generates an alert only

Get Access
Related
Get Access