Detection of Anomalies on Real Network Data u Anomalies/attacks picked by MINDS include scanning activities, worms, and non-standard behavior such as
{"Image DocumentName": "Detection of Anomalies on Real Network Data", "Image ImageDescription": "Anomalies/attacks picked by MINDS include scanning activities, worms, and non-standard behavior such as policy violations and insider attacks. Many of these attacks detected by MINDS, have already been on the CERT/CC list of recent advisories and incident notes. Some illustrative examples of intrusive behavior detected using MINDS at U of M. Scans. August 13, 2004, Detected scanning for Microsoft DS service on port 445/TCP (Ranked#1) Reported by CERT as recent DoS attacks that needs further analysis (CERT August 9, 2004) Undetected by SNORT since the scanning was non-sequential (very slow). Rule added to SNORT in September August 13, 2004, Detected scanning for Oracle server (Ranked #2), Reported by CERT, June 13, Undetected by SNORT because the scanning was hidden within another Web scanning. October 10, 2005, Detected a distributed windows networking scan from multiple source locations (Ranked #1) Policy Violations. August 8, 2005, Identified machine running Microsoft PPTP VPN server on non-standard ports (Ranked #1) Undetected by SNORT since the collected GRE traffic was part of the normal traffic. August & October 30, 2005, Identified compromised machines running FTP servers on non-standard ports, which is a policy violation (Ranked #1) Example of anomalous behavior following a successful Trojan horse attack. February 6, 2006, The IP address X.0 (not a real computer, but a network itself) has been targeted with IP Protocol 0 traffic from Korea (61.84.X.97) (bad since IP Protocol 0 is not legitimate) February 6, 2006, Detected a computer on the network apparently communicating with a computer in California over a VPN or on IPv6. Worms. October 10, 2005, Detected several instances of slapper worm that were not identified by SNORT since they were variations of existing worm code. February 6, 2006, Detected unsolicited ICMP ECHOREPLY messages to a computer previously infected with Stacheldract worm (a DDos agent)", "Image XResolution": "37", "Image YResolution": "37", "Image ResolutionUnit": "Pixels/Centimeter", "Image Software": "SlidePlayer", "Image YCbCrPositioning": "Centered"}