427 Botnet fm qxd

Solutions Fast Track
The Ourmon Web Interface
The ourmon main Web page has three tables at the top.
The first table includes an important link to a help page and a link to
a no-refresh page.
The second table is focused on security.
The third table breaks the main page into subsections, including the
summarization section at the bottom.
www.syngress.com
Ourmon: Anomaly Detection Tools • Chapter 7
279
427_Bot_07.qxd 1/8/07 3:40 PM Page 279

---

The main page is updated every 30 seconds.
The no-refresh page is identical to the main page but is not updated
every 30 seconds.
Data on the main ourmon page is recent (last 30 seconds).
Secondary ourmon pages typically have more data about a particular
filter. For example, the packets filter on the main page shows the
RRDTOOL graph for now. Its secondary page shows all
RRDTOOL graphs, including yearly, monthly, weekly, and daily
graphs.
Each filter section on the main page typically includes a link to a
secondary page as well as a main-page link to the help page
information for that specific filter.
Hourly summarizations for the TCP report, event logs, and top N
talker filters are found at the bottom of the main page.
A Little Theory
Anomaly detection depends on baselining of data so that you must
first understand what is normal. After you understand normal, you
can understand abnormal.
Anomaly detection can point out new anomalies.
Signature detection can tell you if a particular packet or file is evil. It
cannot recognize new evil packets or new evil files and hence is not
good at zero-day attacks.
Anomaly detection may only detect anomalies and might not be able
to explain them.
The hacker rule of economy means that small attacks or small
amounts of spam are unrewarding.