Why would you want to do this on an ids? Al lot of email gateways have a similar funktion (Sender base reputation filtering). I believe it should be perfomed by the email gateway and not the ids/ips system. If you want to do this on your ips I believe it will be overloaded or has to be sized much bigger as normal.
Best regards Bart Knippenberg 2008/11/23 Gautam Singaraju <[EMAIL PROTECTED]>: > All, > > I have been working in email reputation system that has computed > sender reputations for over an year. I believe that there are couple > of efforts to incorporate email reputations into IDSs. Is someone in > the group working on this? Are there any IDSs which can be configured > to perform extensive analysis for non-reputable senders? I would be > interested in sharing this data with other researchers in the group. > > --- > Gautam > > ------------------------------------------------------------------------ > Test Your IDS > > Is your IDS deployed correctly? > Find out quickly and easily by testing it > with real-world attacks from CORE IMPACT. > Go to > http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw > to learn more. > ------------------------------------------------------------------------ > > ------------------------------------------------------------------------ Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.coresecurity.com/index.php5?module=Form&action=impact&campaign=intro_sfw to learn more. ------------------------------------------------------------------------
