News for hackers. Stuff that matters.

A comment on Achieving 100Gbps intrusion prevention on a single server. Parent comment

Re:Achieving 100Gbps intrusion prevention on a single server by sqren on Monday November 16, 2020 @09:43AM (#25112204)
To learn about Intrusion Detection Systems (IDS) I found Unifi's documentation quite helpful. It's specific for their product but most of it is applicable elsewhere.

https://help.ui.com/hc/en-us/articles/360006893234-UniFi-USG...

> What are some common rules that get applied?

This is specifically answered under "Categories and Their Definitions":

> Compromised: This is a list of known compromised hosts, confirmed and updated daily as well.

> Scan: Things to detect reconnaissance and probing. Nessus, Nikto, portscanning, etc. Early warning stuff.

> SpamHaus: This ruleset takes a daily list of known spammers and spam networks as researched by Spamhaus.

> Web Apps: Rules for very specific web applications.

[ Parent | on HN ]
Re:Achieving 100Gbps intrusion prevention on a single server by crispyambulance on Monday November 16, 2020 @10:08AM (#25112541)
OK, thanks! so it can be like a firewall except dynamically updated by subscribing to some kind of service? This would work even for encrypted traffic.
[ Parent | on HN ]