4 ms·
>Care to explain why you think intrusion detection is bullshit? If they're signature based they're not better than antivirus. I have zero faith in signature ba
by lawl 9y ago
>Care to explain why you think intrusion detection is bullshit?
If they're signature based they're not better than antivirus. I have zero faith in signature based systems.
For the stuff that uses machine learning, I have to admit, I have no idea how that stuff performs. But in general I wouldn't trust a machine learning model to not be fooled.
Edit: Add to that HTTPS, I don't buy any claim that they can spot malware traffic from malware that isn't dumb, and I don't think MITMing all traffic is an acceptable solution.
- tptacek 9y agoAnomaly detection doesn't do much better than signature systems do. It finds real stuff, but it "finds" so much garbage that the signal is swamped by it.
- user5994461 9y agoI don't know about network detection systems but antivirus heuristics used to be terrific. You can assign 100 students to develop a trojan for a week. At the end of the week, more than 90% of the software are detected as generic trojan by the antivirus.
- lawl 9y ago> You can assign 100 students to develop a trojan for a week. At the end of the week, more than 90% of the software are detected as generic trojan by the antivirus. Probably because 90 of these 100 students have no idea how AV heuristics work and what the trivial tricks are to completely stomp them.
- user5994461 9y agoSome of them quickly realize that the AV is flagging all their binaries and they try to evade it. They will soon discover that it is far from trivial. Don't underestimate the students and don't underestimate the AV. The world is full of surprises.
- lawl 9y agoI don't have to underestimate AV's because I know how they work, and tested myself how easy it is to bypass them. You either don't or you're employed by one and shilling here.
- dang 9y agoThis crosses into personal attack, which is not allowed here. Please read https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html and follow the rules when commenting here.
- wglb 9y agoI had an intern who came to the job with one he had written in his idle time. Nothing detected this, so I am thinking that it is not hard at all.
- gspetr 9y agohttps://krebsonsecurity.com/2014/05/antivirus-is-dead-long-live-antivirus/ https://krebsonsecurity.com/2014/05/antivirus-is-dead-long-l...
- jstarfish 9y ago> For the stuff that uses machine learning, I have to admit, I have no idea how that stuff performs That's ok. You're in good company with the vendors who sell ML cybersecurity appliances.