[Snort-users] spade reports
James Hoagland
hoagland at ...47...
Sun Jun 17 12:30:51 EDT 2001
At 4:56 PM -0600 6/16/01, Josh Gentry wrote:
>Folks,
>
>Spade is obviously keeping track of a bunch of stats on the
>traffic on the network, to be able to calculate probabilities,
>etc. The logs generated in the spade log dir seem to only
>contain the results of the calculations. Is there any way to get
>spade to report the stats its using to calculate the probability
>that a packet is anomylous?
>
Josh,
If you are using probability mode 3 (the default), the anomaly score
is based on the joint probability of the particular destination IP
and destination port. Specifically it is the negative base-2 log of
that probability*. The probabilities are derived from observing TCP
SYNs on your particular network.
To get the full table of these probabilities (could be quite large),
you can look into the spade-stat mode. Not that using this mode
could introduce a several second delay in snort when the statistics
output is being produced and put in a file. This occurs on certain
signals and on snort exit. (There is no overhead for this mode at
other times.)
See also README.Spade
(http://www.silicondefense.com/software/spice/spicereadme.htm) and
the SPICE web page (http://www.silicondefense.com/software/spice/).
*= at least that is what is supposed to be. There is little
difference from a practical point of view, but I recently discovered
that due to a misplaced parenthesis in the source code, this is not
quite what it is. If A is correct anomaly score (correct meaning
what I described above) and B is what is produced in all released
versions of Spade, A= 0.693*B-0.3665. Note that the what is
currently produce is internally consistent and even proportionate, so
the differnence shouldn't matter from a practical point of view.
We'll need to make the transition at some point through, at least for
use with SPICE.
Sincerely,
Jim
--
|* Jim Hoagland, Associate Researcher, Silicon Defense *|
|* hoagland at ...47... *|
|* http://www.silicondefense.com/ *|
|* Silicon Defense - Technical Support for Snort *|
|* Voice: (530) 756-7317 Fax: (530) 756-7297 *|
More information about the Snort-users
mailing list