# need help on bro **URL:** \ **Category:** Zeek\ **Created:** [November 8, 2007, 8:30pm UTC](https://community.zeek.org/t/need-help-on-bro/1261 "2007-11-08T20:30:08Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [November 8, 2007, 8:30pm UTC](https://community.zeek.org/t/need-help-on-bro/1261/1 "2007-11-08T20:30:08Z")
> \> already be necessary to define what is the normality from a network > \> point of view, which is normal for then giving alarms on what leaves the > \> framework. > > Yes, this is a powerful approach, and one for which Bro is well suited. > In the research world it's termed specification-based intrusion detection, > but this hasn't yet caught on as a term in the commercial world. Let me be a bit more precise. You don't define what is \*normal\*, but rather what is \*allowed\* (including rare-but-okay forms of activity). So you form a specification of allowed behavior and flag any activity that doesn't comply with it. The main drawback of this approach is that it takes considerable manual effort to form the specifications and keep them up to date. (If instead you automatically learn the specifications, then you're back to doing anomaly detection.)     Vern ---
**Author:** ![Jean-Philippe\_Luigg2](https://avatars.discourse-cdn.com/v4/letter/j/aeb1de/32.png) [@Jean-Philippe\_Luigg2](https://community.zeek.org/u/Jean-Philippe_Luigg2)\ **Post date:** [November 9, 2007, 2:38am UTC](https://community.zeek.org/t/need-help-on-bro/1261/2 "2007-11-09T02:38:59Z")
Hello Everybody, > \> \> already be necessary to define what is the normality from a > \> \> network point of view, which is normal for then giving alarms on > \> \> what leaves the framework. > \> > \> Yes, this is a powerful approach, and one for which Bro is well > \> suited. In the research world it's termed specification-based > \> intrusion detection, but this hasn't yet caught on as a term in the > \> commercial world. > > Let me be a bit more precise. You don't define what is \*normal\*, but > rather what is \*allowed\* (including rare-but-okay forms of activity). > So you form a specification of allowed behavior and flag any activity > that doesn't comply with it. Ok, i understand the difference and this makes sense. > The main drawback of this approach is that it takes considerable > manual effort to form the specifications and keep them up to date. Yes, it's the same drawback as of signature's NIDS i think (considering the rules as specifications). And it's why i use Bro for some times. 🙂 > (If instead you automatically learn the specifications, then you're > back to doing anomaly detection.) Speaking of specifications here, do you mean all the traffic ? In all the cases with approachs likes this, we may have to make corrections as with neural networks for example (where we'll have to specify upon a result if it's correct or not). Best regards, Jean-philippe. ---
**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\ **Post date:** [November 9, 2007, 8:30am UTC](https://community.zeek.org/t/need-help-on-bro/1261/3 "2007-11-09T08:30:11Z")
> Yes, it's the same drawback as of signature's NIDS i think (considering > the rules as specifications). Pretty much. Two differences are (1) signatures are easy to share, since they describe attacks, while specifications aren't, since they describe local environments, and (2) signatures are bad at detecting unknown types of attack, while specifications can do this quite well. > Speaking of specifications here, do you mean all the traffic ? Yes, ideally. > In all the cases with approachs likes this, we may have to make > corrections as with neural networks for example (where we'll have to > specify upon a result if it's correct or not). Well, then it starts drifting away from specification-based and towards anomaly detection. In true specification-based intrusion detection, corrections are done manually, to ensure they correspond with intended specification updates.     Vern ---
**Author:** ![jean-philippe\_luiggi](https://avatars.discourse-cdn.com/v4/letter/j/8e7dd6/32.png) [@jean-philippe\_luiggi](https://community.zeek.org/u/jean-philippe_luiggi)\ **Post date:** [November 9, 2007, 12:34pm UTC](https://community.zeek.org/t/need-help-on-bro/1261/4 "2007-11-09T12:34:05Z")
> \> Yes, it's the same drawback as of signature's NIDS i think > \> (considering the rules as specifications). > > Pretty much. Two differences are (1) signatures are easy to share, > since they describe attacks, while specifications aren't, since they > describe local environments, and (2) signatures are bad at detecting > unknown types of attack, while specifications can do this quite well. Sure, it's why i really like the approach used by Bro and specifically the use of policies. With them, i'm able to define my environment and to regulate the parameters of detection compared to this last. > \> In all the cases with approachs likes this, we may have to make > \> corrections as with neural networks for example (where we'll have to > \> specify upon a result if it's correct or not). > > Well, then it starts drifting away from specification-based and > towards anomaly detection. In true specification-based intrusion > detection, corrections are done manually, to ensure they correspond > with intended specification updates. I agree with you, i was not rather precise in my remarks and was speaking of anomaly-based detection using something likes ANN (artificial neural network). 🙂 I guess you may have some traffic at Berkeley so how do you manage defining "allowed" things ? At first a cartography of flows has being made, then you choose to "allow" a few of them and build the specifications ? Best regards, Jean-philippe. ---
**Author:** ![kanthi\_myneni](https://avatars.discourse-cdn.com/v4/letter/k/bcef8e/32.png) [@kanthi\_myneni](https://community.zeek.org/u/kanthi_myneni)\ **Post date:** [November 14, 2007, 5:58pm UTC](https://community.zeek.org/t/need-help-on-bro/1261/5 "2007-11-14T17:58:22Z")
Hi, Much more specific into specification based. Like if there is one specification "a valid SMTP greeting is no longer than NN bytes long . We need to know that NN bytes. Similiarly I believe that there are some specifications built in bro. Is there any way to know more about those specifications like how threshold is set... Can any one suggest me any reference which will help me know more about this stuff... Thanks&Regards, KAnthi. ---
**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\ **Post date:** [May 6, 2022, 3:38pm UTC](https://community.zeek.org/t/need-help-on-bro/1261/6 "2022-05-06T15:38:25Z")