Skip to content

Why Anomaly Based Intrusion Detection Systems Are a Hackers Best Friend

David Maynor

David Maynor explores why anomaly based intrusion detection systems are a hackers best friend at DEF CON 11, examining vulnerability-research and practical defenses.

Summary

Architecture and Background

David Maynor - Why Anomaly Based Intrusion Detection Systems Are A Hackers Best Friend Why Anomaly Based Intrusion Detection Systems Are A Hackers Best Friend The security market is booming. New types of tools are emerging all the time with promises of being able to protect networks better than the last generation.The newest trend is anomly based intrusion detection systems.These systems claim the ability to detect new types of attacks before comprable signature based systems while being able to scale to higher network speeds. Are these claims true?

Vulnerability Analysis

Will these systems be the silver bullet to protectthe clueless? Are these tools any better than the other script kiddie prevention tools? This talk will answer these questions and more.

Exploitation and Demonstrations

New and improved Icer 3.1.4 is smarter and faster than the previous versions. He's more l33t than ever and his skill at breaking security tools is best. Not to mention he knows 20 ways to make the ladies call him Big Daddy.

Remediation and Defensive Strategies

Icer exists in a world beyond your world. What we only fantasize, he does. He lives in Atlanta, where nothing is beyond him, including ripping quotes from bad movies and consuming large amounts of guinness at the Highlander. Icer is still amazed Martin Sargent answers emails.

Related talks

Main Stage·1 hr 5 min

  • DEF CON
  • Red Team
  • Date: Jul 2012
  • Location: Las Vegas

Dan Kaminsky

Dan Kaminsky details black Ops Dan Kaminsky Chief Scientist, DKH If there's one thing we know, it's that we're doing it wrong.

penetration-testingvulnerability-researchexploit-development+1

Main Stage·41 min

  • DEF CON
  • Red Team
  • Date: Jul 2012
  • Location: Las Vegas

Dustin Hoffman · Semon Rezchikov

Dustin Hoffman and Semon Rezchikov details busting the BARR: Tracking "Untrackable" Private Aircraft for Fun &Profit Dustin Hoffman President & Senior Engineer, Exigent Systems Inc.

penetration-testingvulnerability-researchexploit-development+1