Only if there's a rule written for the anomaly, it's a signature based program.
Ah Young Jedi - you are mistaken about that … -P
There is a Snort Plugin called SPADE ( Statistical Packet Anomaly Detection Engine ) - and it is documented in the "Snort Cookbook" from O'Reilly.
It was created by Silicon Defence as part of a DARPA project before funding was killed and they went the way of the dinosaurs …
Google should provide a link to it's download location, failing that, I have a copy …
Azrael
Ah Young Jedi
LOL. Young, what's that? D
There is a Snort Plugin called SPADE ( Statistical Packet Anomaly Detection Engine ) - and it is documented in the "Snort Cookbook" from O'Reilly.
Well, a SPADE for the Barnyard. Makes sense, thanks
LOL. Young, what's that?
It's what those of us that remember the original use of Young Jedi wish for.
thanks for the replies thus far, they've been very helpful ) - the project is starting to come together.
However, im required to show the project addresses (where applicable) any needs created by the lacking ability of current tools, prefferably by asking people knowlegable in the area.
to this end, does anyone have any input on how ethereal (in this instance) might not provide some functionality you require to perform forensics, or is lacking in anouther way (complicated UI, etc etc).
again, not a problem if noone can suggest anything, but i need to ask )
I suspect the biggest issue using Ethereal/Wireshark isn't the tool, but rather the need to understand the network protocols as well as the tool requires. The second issue is the need to pick the packets of interest out of the overwhelming amount of data. That is where snort as a pre-processor is such a helpful add on.
Well, to the best of my knowledge, you are still lacking anomaly detection …