Stories
Slash Boxes
Comments

Slashdot

News for nerds, stuff that matters

Create Account | Retrieve Password

Stories

Slashdot Log In

Create Account | Retrieve Password

OpenBSD Gains "Fuzzy" User Profiling IDS

Posted by timothy on Tue Dec 09, 2003 09:15 PM
from the and-who-the-hell-are-you dept.

NaveWeiss writes "According to the OpenBSD Journal, major work has been done on an innovative new OpenBSD feature termed 'fuzzy user profile' intrusion detection system' - or 'fupids.' According to Steffen Wendzel, the code 'creates profiles for every user who does an execve() syscall on obsd systems.'"

+ -

slashdot story

This discussion has been archived. No new comments can be posted.

OpenBSD Gains "Fuzzy" User Profiling IDS More

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Without JavaScript enabled, you might want to use the classic discussion system instead. If you login, you can remember this preference.

- Re:Link? (Score:4, Informative)
  
  by OldMiner (589872) * writes: on Tuesday December 09 2003, @09:43PM (#7676318) Journal
  
  Oh, it really is hard to click on the link on the linked page, or, even worse, search Google for FUPIDS and find the page in, as he puts it, "my poor English" [doomed-reality.org]. Pretty sparse on details when you get to it anyhow. Use the source, Luke.
  
  Parent
Courtest of Babelfish (Score:4, Informative)

by thelaw (100964) writes: <spam@@@cerastes...org> on Wednesday December 10 2003, @01:11AM (#7677621) Homepage

FUPIDS (fuzzy user of profiles intrusion detection system) is a Patch for the OpenBSD -- Kernel. FUPIDS produces user profiles and supervises their activities. Momentarily is limited to the evaluation of the programs used by the user, however still by some intelligent ueberwachungsstrategien will extend. Which I still planned at nice features experience one as soon as I it programmed and/or for any reasons directly into the ton DO -- list on the project side wrote.

babelfish. [altavista.com]
- Re:Courtest of Babelfish (Score:2)
  
  by Valar (167606) writes:
  
  Now if I only knew what 'ueberwachungsstrategien' was...
  - Re:Courtest of Babelfish (Score:2, Informative)
    
    by chthonicdaemon (670385) writes:
    
    Looks like supervisory strategies to me (my german is not great).
    - Re:Courtest of Babelfish (Score:1)
      
      by CableModemSniper (556285) writes:
      
      I would agree. (with as bad or worse german then you of course).
      - Re:Courtest of Babelfish (Score:1)
        
        by vidnet (580068) writes:
        
        I'd agree too, with no german skills.
        
        German: ueber wachungs strategien
        English: over watching strategy
        (Latin-ish: super visio strategy)
        
        Yay for germanic languages!
    - Yes, you are right (Score:1)
      
      by foobsr (693224) writes:
      
      CC.
...noexec/ro on partitions... (Score:5, Interesting)

by Hobart (32767) writes: on Wednesday December 10 2003, @01:25AM (#7677697) Homepage Journal

Another good move along these lines, I think, might be to mount all partitions as noexec, and mount all the partitions with executable content as read-only...
- Re:...noexec/ro on partitions... (Score:3, Interesting)
  
  by anthonyrcalgary (622205) writes:
  
  That would be a major pita if they did it by default...
  - Re:...noexec/ro on partitions... (Score:1, Funny)
    
    by Anonymous Coward writes:
    
    Mmm, major pita...
- Re:...noexec/ro on partitions... (Score:1, Troll)
  
  by irc.goatse.cx troll (593289) writes:
  
  And you get to go singleuser every time you want to make a software upgrade.
- Re:...noexec/ro on partitions... (Score:3, Interesting)
  
  by tiger99 (725715) writes:
  
  I wonder how that would compare to a well-known badly broken OS, where you can't even make some executable files, and dlls, RO without breaking everything. Keeping all the executable stuff in RO partitions has its attractions, if it is possible to work that way.
  Taking this a step further, if it was not for the performance problem, could you not just put the executables on a CD (in a read-only drive of course), which could be updated only by having physical access, and a suitably equipped PC with writer to t
Does it log activity? (Score:4, Interesting)

by fuzzybunny (112938) writes: on Wednesday December 10 2003, @09:11AM (#7679520) Homepage Journal

He mentions that it sets a threshhold of user activity, such as using too many new programs within a limited space of time.

Any indication that it does some sort of observation of user activity (think bayesian learning for spam filters) to build profiles which, if exceeded by too high a metric within too short a time, would also trigger a log error?
Fupids is not in OpenBSD's tree (Score:4, Informative)

by OttoM (467655) writes: on Thursday December 11 2003, @07:17AM (#7688651)

The summary suggests fupids is imported into the OpenBSD tree.
This is not true. Fupids is work by a single person, who is not an OpenBSD developer. At this point in time, nothing suggests it will be put into the OpenBSD tree.
NOT in the tree (Score:2, Informative)

by Geekboy(Wizard) (87906) writes:

This code is not in the tree, and it doesn't look like it will be.
- Re:BSD for Windows XP? (Score:2, Funny)
  
  by Paleomacus (666999) writes:
  
  All I can say is -- HUH?
  - Re:BSD for Windows XP? (Score:1)
    
    by Guido von Guido (548827) writes:
    
    Troll/smartass remark.
  - Re:BSD for Windows XP? (Score:1)
    
    by mattjb0010 (724744) writes:
    
    Actually it's not quite as crazy it sounds. Cygwin is basically a Linux-esque environment running on top of a Windows kernel, the BSD layer in Mac OS X runs directly on top of the Mach-based microkernel (side-by-side with Aqua, not Aqua on top of BSD as many believe).

There may be more comments in this discussion. Without JavaScript enabled, you might want to turn on Classic Discussion System in your preferences instead.

Slashdot

News for nerds, stuff that matters

Slashdot

Site Info

Stories

Slashdot Log In

OpenBSD Gains "Fuzzy" User Profiling IDS

OpenBSD Gains "Fuzzy" User Profiling IDS 50 Comments More Login /

Please Log In to Continuex

Re:Link? (Score:4, Informative)

Courtest of Babelfish (Score:4, Informative)

Re:Courtest of Babelfish (Score:2)

Re:Courtest of Babelfish (Score:2, Informative)

Re:Courtest of Babelfish (Score:1)

Re:Courtest of Babelfish (Score:1)

Yes, you are right (Score:1)

...noexec/ro on partitions... (Score:5, Interesting)

Re:...noexec/ro on partitions... (Score:3, Interesting)

Re:...noexec/ro on partitions... (Score:1, Funny)

Re:...noexec/ro on partitions... (Score:1, Troll)

Re:...noexec/ro on partitions... (Score:3, Interesting)

Does it log activity? (Score:4, Interesting)

Fupids is not in OpenBSD's tree (Score:4, Informative)

NOT in the tree (Score:2, Informative)

Re:BSD for Windows XP? (Score:2, Funny)

Re:BSD for Windows XP? (Score:1)

Re:BSD for Windows XP? (Score:1)

Please Log In to Continuex

Close

Slashdot

News for nerds, stuff that matters

Slashdot { color: "", viewname: "stories", filter: "", name: "Main", id: 13 }

Site Info

Stories

Slashdot Log In

OpenBSD Gains "Fuzzy" User Profiling IDS

OpenBSD Gains "Fuzzy" User Profiling IDS 50 Comments More Login /

Please Log In to Continuex

Re:Link? (Score:4, Informative)

Courtest of Babelfish (Score:4, Informative)

Re:Courtest of Babelfish (Score:2)

Re:Courtest of Babelfish (Score:2, Informative)

Re:Courtest of Babelfish (Score:1)

Re:Courtest of Babelfish (Score:1)

Yes, you are right (Score:1)

...noexec/ro on partitions... (Score:5, Interesting)

Re:...noexec/ro on partitions... (Score:3, Interesting)

Re:...noexec/ro on partitions... (Score:1, Funny)

Re:...noexec/ro on partitions... (Score:1, Troll)

Re:...noexec/ro on partitions... (Score:3, Interesting)

Does it log activity? (Score:4, Interesting)

Fupids is not in OpenBSD's tree (Score:4, Informative)

NOT in the tree (Score:2, Informative)

Re:BSD for Windows XP? (Score:2, Funny)

Re:BSD for Windows XP? (Score:1)

Re:BSD for Windows XP? (Score:1)

Please Log In to Continuex

Close

Slashdot