42. Evading IDS, Firewalls and Honeypots – Detection Games
42.2 Signature vs Anomaly IDS – False Positives and False Negatives
Signature / rule-based (Snort, Suricata rule language, many WAF rules): "if this byte pattern / this flow looks like known Nmap / known exploit kit → alert". Fast, explainable, interview-friendly. Misses brand-new payloads (false negative) until a rule exists.
Anomaly / baseline: "this host never did 4000 unique dest ports at 02:00" → alert. Catches unknowns; also catches the new backup job (false positive). SOC then hates the sensor – dangerous, because next step is disable.
Thodkyaat:
- False positive (FP) = alert, no real incident. Too many → alert fatigue.
- False negative (FN) = real attack, no alert. Silent fail. Exam modules love this pair.
- True positive = alert + real. Tune toward this; log the miss.
Snort / Suricata idea (Blue, not a payload kit): alert tcp any any -> $HOME_NET any (msg:"…"; flow:…; sid:…;). HOME_NET lab madhe 192.168.56.0/24 theva. Emerging Threats / ET Open rules = starting point; your local.rules = SME-specific (Raja-Rani billing port, etc.).
| Red team (attacker) does | Blue team (defender) detects / stops |
|---|---|
| Slightly changes a known payload so old signature misses (FN) | Protocol parsers + content-normalise; update rules; anomaly on rare dest |
| Floods junk alerts so real C2 hides (FP noise) | Thresholds, suppress with evidence, don't "sid: disable all" |
| Lives in allowed HTTPS to a CDN-like host | TLS/SNI/JA3-class telemetry, DNS logs, egress allow-list |
Ravindra Bagale's Tip
Students turn the default rules ON and then delete 10,000 alerts. Tuning = change HOME_NET, disable the 5 noisy lab SIDs with a ticket, not alert → /dev/null. Interview: define FP vs FN in one sentence each. Keep this in mind.
Ravindra Bagale's Tip – मराठी
Students default rules ON करतात आणि 10,000 alerts delete करतात. Tune = change HOME_NET, disable the 5 noisy lab SIDs with a ticket, alert → /dev/null नाही. Interview: FP vs FN प्रत्येकी एका वाक्यात सांगा. लक्षात ठेवा.
Ravindra Bagale's Tip – हिंदी
Students default rules ON करते हैं और 10,000 alerts delete कर देते हैं. Tune = change HOME_NET, disable the 5 noisy lab SIDs with a ticket, alert → /dev/null नहीं. Interview: FP vs FN एक-एक वाक्य में बताओ. ध्यान रखो.
Lab
On paper: one FP story (Zoya's nmap of OWN Metasploitable during approved class → SOC panic) and one FN story (slow scan below threshold). Write the tune action for each (allow-list Kali IP in lab only vs longer window). 8 lines.