Stories
Slash Boxes
Comments

Slashdot

News for nerds, stuff that matters

Create Account | Retrieve Password

Stories

Slashdot Log In

[ Create a new account ]

OpenBSD Gains "Fuzzy" User Profiling IDS

Posted by timothy on Tue Dec 09, 2003 09:15 PM
from the and-who-the-hell-are-you dept.

NaveWeiss writes "According to the OpenBSD Journal, major work has been done on an innovative new OpenBSD feature termed 'fuzzy user profile' intrusion detection system' - or 'fupids.' According to Steffen Wendzel, the code 'creates profiles for every user who does an execve() syscall on obsd systems.'"

[+] (tagging beta)

This discussion has been archived. No new comments can be posted.

OpenBSD Gains "Fuzzy" User Profiling IDS | Log In/Create an Account | Top | 54 comments | Search Discussion

The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Without JavaScript enabled, you might want to use the classic discussion system instead. If you login, you can remember this preference.

Courtest of Babelfish (Score:4, Informative)

by thelaw (100964) <spam AT cerastes DOT org> on Wednesday December 10 2003, @01:11AM (#7677621)
(http://www.cerastes.org/)

FUPIDS (fuzzy user of profiles intrusion detection system) is a Patch for the OpenBSD -- Kernel. FUPIDS produces user profiles and supervises their activities. Momentarily is limited to the evaluation of the programs used by the user, however still by some intelligent ueberwachungsstrategien will extend. Which I still planned at nice features experience one as soon as I it programmed and/or for any reasons directly into the ton DO -- list on the project side wrote.

babelfish. [altavista.com]
- Re:Courtest of Babelfish by Valar (Score:2) Wednesday December 10 2003, @09:13PM
  - Re:Courtest of Babelfish by chthonicdaemon (Score:2) Friday December 12 2003, @02:10AM
    - Re:Courtest of Babelfish by CableModemSniper (Score:1) Friday December 12 2003, @05:18AM
      - Re:Courtest of Babelfish by vidnet (Score:1) Saturday December 13 2003, @09:27AM
    - Yes, you are right by foobsr (Score:1) Friday December 12 2003, @09:54PM
...noexec/ro on partitions... (Score:5, Interesting)

by Hobart (32767) on Wednesday December 10 2003, @01:25AM (#7677697)
(http://www.jb.org/ | Last Journal: Wednesday September 28 2005, @10:17PM)

Another good move along these lines, I think, might be to mount all partitions as noexec, and mount all the partitions with executable content as read-only...
- Re:...noexec/ro on partitions... by anthonyrcalgary (Score:3) Wednesday December 10 2003, @04:33AM
  - Re:...noexec/ro on partitions... by Anonymous Coward (Score:1) Wednesday December 10 2003, @02:37PM
- Re:...noexec/ro on partitions... by irc.goatse.cx troll (Score:1) Wednesday December 10 2003, @12:29PM
- Re:...noexec/ro on partitions... by tiger99 (Score:3) Thursday December 11 2003, @02:34PM
Does it log activity? (Score:4, Interesting)

by fuzzybunny (112938) on Wednesday December 10 2003, @09:11AM (#7679520)
(http://www.zog.net/ | Last Journal: Friday December 12 2003, @07:21AM)

He mentions that it sets a threshhold of user activity, such as using too many new programs within a limited space of time.

Any indication that it does some sort of observation of user activity (think bayesian learning for spam filters) to build profiles which, if exceeded by too high a metric within too short a time, would also trigger a log error?
Fupids is not in OpenBSD's tree (Score:4, Informative)

by OttoM (467655) on Thursday December 11 2003, @07:17AM (#7688651)

The summary suggests fupids is imported into the OpenBSD tree.
This is not true. Fupids is work by a single person, who is not an OpenBSD developer. At this point in time, nothing suggests it will be put into the OpenBSD tree.
- 1 reply beneath your current threshold.
NOT in the tree (Score:2, Informative)

by Geekboy(Wizard) (87906) <spambox AT theapt DOT org> on Thursday December 11 2003, @12:12PM (#7690906)
(http://www.theapt.org/ | Last Journal: Tuesday August 19 2003, @11:58AM)

This code is not in the tree, and it doesn't look like it will be.
Re:Link? (Score:4, Informative)

by OldMiner (589872) * on Tuesday December 09 2003, @09:43PM (#7676318)
(Last Journal: Monday January 30 2006, @10:24PM)

Oh, it really is hard to click on the link on the linked page, or, even worse, search Google for FUPIDS and find the page in, as he puts it, "my poor English" [doomed-reality.org]. Pretty sparse on details when you get to it anyhow. Use the source, Luke.

[ Parent ]
- 1 reply beneath your current threshold.
Re:BSD for Windows XP? (Score:2, Funny)

by Paleomacus (666999) on Sunday December 14 2003, @12:41AM (#7714588)

All I can say is -- HUH?

[ Parent ]
- Re:BSD for Windows XP? by Guido von Guido (Score:1) Thursday December 18 2003, @05:06PM
- Re:BSD for Windows XP? by mattjb0010 (Score:1) Monday December 22 2003, @01:27AM
25 replies beneath your current threshold.

Slashdot

News for nerds, stuff that matters

Slashdot

Site Info

Stories

Slashdot Log In

OpenBSD Gains "Fuzzy" User Profiling IDS

Courtest of Babelfish (Score:4, Informative)

...noexec/ro on partitions... (Score:5, Interesting)

Does it log activity? (Score:4, Interesting)

Fupids is not in OpenBSD's tree (Score:4, Informative)

NOT in the tree (Score:2, Informative)

Re:Link? (Score:4, Informative)

Re:BSD for Windows XP? (Score:2, Funny)

Please Log In to Continuex

Close

Slashdot

News for nerds, stuff that matters

Slashdot { color: "", viewname: "stories", filter: "", name: "Main", id: 13 }

Site Info

Stories

Slashdot Log In

Related Links

OpenBSD Gains "Fuzzy" User Profiling IDS

Courtest of Babelfish (Score:4, Informative)

...noexec/ro on partitions... (Score:5, Interesting)

Does it log activity? (Score:4, Interesting)

Fupids is not in OpenBSD's tree (Score:4, Informative)

NOT in the tree (Score:2, Informative)

Re:Link? (Score:4, Informative)

Re:BSD for Windows XP? (Score:2, Funny)

Please Log In to Continuex

Close

Slashdot