Putting an Intrusion Detection System to the Test

on YouTube ↗48m

" summary

Demonstrates practical testing of an IDS/IPS using the Pytbull framework with Nmap and Metasploit to run a client/server attack campaign across 11 modules and about 300 test cases, producing HTML reports. Shows test architecture (single vs dual-interface), configuration snippets, rule tuning, and findings including misconfigured rules, false positives and false negatives, throughput and resource impact measurements, and blind spots for encrypted traffic.

AI-written summary · about

" chapters (10)

1. 0:00Introduction
2. 2:10Intrusion detection systems
3. 5:27IDS vs IPS differences
4. 8:59IDS architecture
5. 12:55Testing focus areas
6. 15:04Pitbull architecture
7. 18:55Pitbull test types
8. 22:31Live Pitbull demo
9. 29:18Recommendations and resources
10. 30:00Q&A

" related talks

• 24mA Study on Intrusion Detection Systems with a Practical Experiment on SnortVigneshwar Sethuraman · BSides Vancouver 2021
• 43mOpen Source Intelligence Based Intrusion Detection SystemIvo Vacas · BSides Lisbon 2018
• 17mExpansion of ICS Testbed for Security Validation based on MITRE ATT&CK TechniquesJeong-Han Yun, HyoungChun Kim, Seungoh Choi, Jongwon Choi, Byung-Gil Min · 13th USENIX Workshop on Cyber Security Experimentation and Test (CSET '20)
• 19mPenetration TestingBrandy Griffin · DevOpsDays Atlanta 2022
• 01h 01mA security tester's toolkitNiall Merrigan · Build Stuff 2017
• 29mDetection Engineering: Defending Networks with PurposePeter Di Giorgio · Security Onion Conference 2021
• 39mImproving OT Network and Host Baselines to Secure Critical InfrastructureDan Gunter, Gabe Weaver · RSAC 2023
• 01h 27mProactive Defense: Leveraging Hacker Tools for Early Vulnerability DetectionTobit Lill · code.talks 2023