gdbassett/Flow-Weaver — Issue #1: Matching Bad Packets
Author: gdbassett
Created: 2012-02-02 20:45:14+00:00
State: open

Need to decide how to match bad packets.
1. Will IDS be done in the controller or in something else?

2a. If done in the controller, how will we access and match the data portion of packets? (And is this approach even sustainable?)

2b. If done in an IDS, what information is passed to the controller to use to match packets for response? (Easy way out would be source IP but it would be nice to also match other things like TTL, etc.)

Probably want to engineer a whole separate reputation system for taking IDS, intel, and collected information to profile a threat which still goes back to, what information does the controller get from the threat profiler to use to match specific packets?

1. Match white list of known good (srcip, dstip, srcmac, dst,mac, srcport, dstport, ttl.) (could add crypto sig later)
2. Match black list of known bad (srcip)
3. If first 2 fail, send packet to treat profiler to try and match.