Real time threat detection

Hello,
To make real time detection more effective,
how to find the Cisco device alert pattern for real time detection of attack?
For example, SQL slammer worm, Cisco IDS will fire its related/specific signature. For any Trojan activity IDS will fire specific signature.
But how to find a signature patter, or packet pattern for session hijack, ip spoofing and other IP based attacks? (not related to applications)
Is there any knowledge source, which can show traffic/packet pattern generated by IP based attacks/protocol behavior in attack? What kind of alerts for what kind of attack, sequence of alerts, etc.
I am using netForensics for real time threat detection; I want to make some rules which will match the IP behavior/IDS signature generation pattern in progressing attack.
I am looking for such kind of knowledge base, if any one have experience in this please help me out.
Regards
Kapish

hi, that was a cool link.
But it didnt show any information on attack progress, stages of attack and alert pattern that normal Cisco IDS will generate for the same.
I am looking for deep analytical information, which will show me how to correlate alerts manually. I am using netForensics, I want to make rules in it for IDS and PIX using my understanding to find attack at its point of progress.
regards
Kapish

Similar Messages

Detecting PDF-image files in real time

Hi,
I'm planning to build a web application that allows users to upload PDF files. I want to be able to check the PDF files in real-time to ensure they only upload PDF text-searchable files, and not PDF image files. Is there anything from Adobe that has this functionality?
I'll probably to integrating it into a .NET web application.
Thanks.

Hi Leonard - thanks for the reply.
I've read up more about Adobe LiveCycle ES and it seems it might be a bit of an overkill for what I'm trying to do. I just need to have some software to check the PDF document whether it is text-searchable or not. LiveCycle appears to be a full document management and processing suite. Is there any more basic Adobe software that can do this kind of check?
Thanks much.

How to count occurences of a certain string in incoming real-time data? Also displaying RTC data. Current VI included

I use LabView student Express 7 on a Windows XP system.
Time-frame: we are doing final integrations for our balloon experiment today. We just got told that the press wants to view real-time data, which we haven't programmed for. I need help to get a working VI at the latest by 25.02.2004 before 0800(morning) (GMT+1).
Note on license
It is a student balloon flight, and the data will not be used in scientific work, so the I am not breaking any license agreements (I hope).
Problem synopsis:
The balloon continually transmits data at 9600baud. The data is a semi-repeating header followed by a constant lenght data-package arranged like this:
BEXUS[h][m][s]BEXUS[h][m][s]
[Raw binary data, 7channels*8sub-channels*8bits]
What the groundstation is doing right now:
Take all incomming data and save (append) the data to a file without any data-handling. (We figured we would go post-processing).
What I need to change in less than 24 hours:
- Add a "package" counter
- Add a display of the clock data (RTC)
How I planned to implement the changes:
-RTC display:
The RTC data is in BCD format, since that means that if you look at the data as hex numbers, you get the hours and minutes and seconds out in "clear text". That is 12 hours is 0x12hex. I figured that I can do a match pattern BEXUS and pass the "after substring" to another match pattern BEXUS from which I feed the "before substring" to a type-cast VI (casting string to u8) and displaying that, which should give me a display of "123000" for the time 12:30:00... I couldn't get it to work at all when I tried out the supplied "beta" vi.
- Package counter:
Counting how many BEXUS that gets detected and dividing by 2. I don't know how to do this. I've looked on the forum (a good thread on the problem: "how do I count the number of *'s in a string") but these use either loops or arrays... and I'm not sure how this works when I'm getting the data in at realtime. I cant make an array and then count it, since then the array would grow fast and possibly interfere with saving of the data??? Saving the data is critical.. without that file we cant do post-processing.
Since my time is so limited (I'm not even supposed to do the groundstation software but they called on me in the last minute because no-one else had time/wanted too/could do it) I hope that you could make an exception and provide me with working VI's (based on the one I have attached) so that I can show something to the press! (Free comercial for NI!! Since the student version shows the National Instruments water-mark on all VI's!!! Possible TV time!!)
Thanks!
PS: even if you are to late (after 25) post anyway!
Why:
-I can learn from it
-the launch might be delayed due to weather conditions
-others might find it amusing!
Thanks again!
Attachments:
BexusII_groundstation.vi ‏46 KB

I have a valid example data file attached to this thread.
If you open BEXTEST.bin in a hex-editor of your choice, you'll see the BEXUS as 42 45 58 55 53 and then the time as 00 28 09 etc.
I couldn't get Joe Guo's VI to work. It doesn't count packages correctly, and the time is not displayed correctly either.
The file was saved using a straight save to file VI.
The data is from actual launching area tests performed a few mintues ago. The time displayed is "On time" e.g. how long the gondola has been powered up.
I have a spare T-junction, so I can hook into the balloon real-time data as we fly, in case anyone care to see if they can figure out why the latest version of Joe Guo's program is not displaying correctly.
I will monitor this
thread during and after flight to see if anyone can make it in time!
Thanks for the great effort!!
Attachments:
bextest.bin ‏53 KB

HT1553 What is the best system for a real time cloud back up of documents? My MacBook crashed, and I lost 2 hours of writing and could not find a way to restore it.

My MacBook Pro crashed while I was rewriting a book, lost more than an hour of work and could not find a way to restore it. Did not have Time Machine set up, but it appears that Time Machine does not have Real Time back up and documents must be manually stored.
I need an automatic, real time back up to keep this from happening - I'm not happy my MacBook has crashed twice now. What is the best cloud system for Real Time backup? Thanks to anyone who can help me, I'm not the most astutde computer guy... James

One way would be to use Dropbox, or a similar sync service, and just keep your critical documents in the appropriate folder. Dropbox, at least, keeps a local copy of everything and syncs automatically to the cloud whenver a change is made. Dropbox is free for up to 2GB of data.
There are also true backup services such as CrashPlan+:
http://www.crashplan.com/consumer/crashplan-plus.html
which provide automatic backups whenver a change is detected. It's not free, but usually such services aren't too expensive unless you need to back up a lot of data.
Regards.

Real Time TCP/IP communication

Hi,
I am using the following hardware:
PXIe-1062Q
PXIe-8108
PXI-5600 (02 card for 40MHz Bandwidth)
PXIe-5641R (both inputs are used; one for each PXI-5600)
PMA-1115
Labview 2009
I am using instrument mode to detect the real time hopping signal and writing it to a spreadsheet.
My question is that how can I transfer data on LAN in real time to create a waveform in software on a remote computer before writing it to spreadsheet. I am looking for something like real time TCP/IP communication.I have attached my VI. Kindly guide me that how can I do this?
Thanks and Regards,
Rashid
Solved!
Go to Solution.
Attachments:
FOR.vi ‏54 KB

Hey Rashid,
Check out this tutorial with examples and let me know if it helps.
Stephanie O.
DIAdem Product Manager
National Instruments

Real time pattern recognition

I'm trying to build a pattern recognition system, so that I can detect in real time "STOP" traffic signs. I've build a template and a script using Vision Assistant, an then I used the "Export to VI" option. I've been trying to modify the generated VI, to add the webcam part. I can't figure out what's wrong, as the program captures video, but the pattern recognition part doesn't behave as I want,it just applies some image filters and displays the first captured image. I'm a begginer in LabVIEW, please help me figuring out what's wrong. It should show the captured video, marking the pattern if one is found. Thanks
Attachments:
Capture.vi ‏146 KB
sign.vascr ‏3 KB

Hi Nathan,
Thanks for the reply. I've managed to solve some of the issues. I've given up trying to do the geometric matching real time. I just want to do this against a couple of local images. My big problem right now is that I can't manage to display the overlay over the initial image, as this gets distorted in the process (applying the color threshold, the equalize feature and so on). I guess I don't understand correctly how the matching algorithms work. I would greatly appreciate if you could point me in the right direction...basically, I want to display a rectangle overlay over the initial image. I have a couple of questions from there on, but I want this solved first. I've attached my latest VI, the VisionAssistant script for detecting the signs and an image I use to test. Thank you
Attachments:
GeometricPattern_File.vi ‏88 KB
sign.vascr ‏3 KB
road_sign3.jpg ‏45 KB

How can I find the minimum in real time

I 'am doing some type of sensing mechanism. I that the data is step count versus intensity. So I want to record the minimum in real time from. Please kindly help

Hi perumpadapu,
you should have learned by now to provide some meaningful example (data)…
There are functions to detect minima: ArrayMinMax, "smaller than" comparison, PtByPtArrayMinMax, MinMax comparison, ...
It all depends on your data!
Best regards,
GerdW
CLAD, using 2009SP1 + LV2011SP1 + LV2014SP1 on WinXP+Win7+cRIO
Kudos are welcome

"Waiting for real-time target (RT PXI target) to respond" error when the program waits interrupts

Hi there,
I have developed an application to detect interrupts generated by a electronic card and act in consequence. The program has been developed in labview but it calls a dll; that was created with labwindows. The dll is programmed to open the visa communication, enable events and install the interrupt handler and when an interrupt is detected, it reads the value of the different registers of the card and returns it to labview to visualize them.
The problem is that when the program waits for an interrupt, a prompt appears with the message "Waiting for real-time target (RT PXI target) to respond" and the only option I have is to click on the button to disconnect from the pxi or just wait. If I wait and I generate an interrupt, the prompt disappears and the application visualize the data like it was expected.
To wait for the interrupt the following code has been programmed in the function:
while (flag == 0)
Sleep (1000);
When an interrupt occurs, the value of flag changes to 1 and the function continue without any problem. I am not really sure, but probably here is the problem and probably this is not the best way to wait for an interrupt because the sleep function suspends the thread for the configured time, but at least the computing load in the PXI is between 0% and 1%. I was wondering if somebody knows how to wait for an interrupt without "lost" the communication with the PXI and if there is a better way to do it.
Any answer will be welcome and thanks for them,
Jaime
Solved!
Go to Solution.

Hello Naity,
First of all, in which thread runs the waiting process? Is it scheduled in another thread than the function setting the flag?
It scheduled in the same thread that I use to configure the communications and configure the card. Anyway, here is the pseudo code of the function interrupt that I programmed under labwindows,.
char* interrupt(void)
1. Open visa communications
2.Install handler interrupt --> status = viInstallHandler (instr, VI_EVENT_PXI_INTR, IntrHandler, VI_NULL); // the function IntrHandler will be called when an interrupt occurs
3. Enable event PXI interrupt
4. Wait
while (flag == 0)
Sleep (1000);
5. Visualize the data coming from the interrupt (registers and values measured with the card)
6. Uninstall handler interrupt
7. Close visa session
The interrupt handler function IntrHandler is called immediately when an interrupt occurs and the pseudo code is like this
ViStatus _VI_FUNCH IntrHandler(ViSession instr, ViEventType etype, ViEvent event, ViAddr userhandle)
1. Disable some functions of the card to avoid damages.
2. Read registers and put them in a buffer
3. Change the value of flag ---> flag = 1;
In labview, I call the function interrupt with a call library function node (see the capture attached) and the program reads and saves the data from returned from the function.
Secondly, I am not sure this method is the most elegant. You could for example register an event with the function and, insteand of setting a flag to 1, trigger the event and schedule it in another thread (if the function is thread safe). This could reduce your CPU Load even more and seem a bit cleaner to me.
I've never used events before in labwindows but I will try to do it in this way. But anyway, I suppose that I should; somehow, wait the event to occurs in labview while the waiting for the event is programmed inside the dll...and probably the same prompt that i am trying to avoid is going to appear again, because I am not returning the "control" to labview (I mean, labview executes the dll and waits for the event to occur. Then the execution of the labview program is stopped in the call library function node executing the dll)
Third point, which environment of development are you using?
I am working with LV 2010 sp1 and Labwindows cv 10.0.1 and with the real time module.
I did also another test, I divided the program in different functions, one to initialize the communication, another to wait until a interrupt has been detected and the other to obtain the data from the interrupt and close communications. With labview I call first with the call library function node the function to initialize, later I call inside a while loop the wait function like this
int waitAseconds (double seconds, short stop_waiting)
if(flag==1 || stop_waiting == 1)
flag = 1; //to detect the stop_waiting button
printf("flagAA =1 stop waiting = %d time = %d\n", stop_waiting, clock());
return flag;
else
SleepUS(seconds*1000000);
//a++;
printf("flag a= %d stop waiting = %d time = %d\n", flag, stop_waiting, clock());
return flag;
and when the program detects an interrupt, the function returns to labview the flag and stops the loop. Finally, it reads the values and close communications.
In this way, the prompt appears but after running the application for 10 or 20 minutes and also i checked that there is a time gap between the executions in the loop.
Thanks for your reply and your help,
Jaime
Attachments:
capture.png ‏40 KB

TCP/IP Connecting with Real Time Controller

I have a host running Labview on a windows XP and a realtime embedded controller on a pxi chassis that acts as the server. When the realtime is started it automatically goes into listen mode and listens for a connection from the host. The host opens a connection. After a valid connection is open the Real-Time side goes into a TCP_Read and the host can then send commands that the real time processes and sends to the FPGA on the pxi-chassis.
Now the problem I'm having is how to handle the case when a TCP connection is lost. I can have the TCP_Read on the real-time error on a time out and then go into a listen mode but this isn't very logical because then the host will have to reconnect each time a time out occurs. So if I make the TCP_Read timeout be infinite and if the connection is lost (let's say I unplug the ethernet cable and re-plug it back in) then I cannot recover from this and the Real-time will need to be re-booted.
I've tried to send the Real-time into listen mode if the error code is other than a timeout error (code 56) and have it go back to TCP_read mode if it is a timeout error. But if the connection is lost by means of a physical way (such as me pulling the ethernet wire and plugging it back in) then the Real-Time never sees that the connection is invalid. The host on the other hand can detect it bc it will get an error when it's trying to write?
So my is:
Is there any way to prevent an infinite loop that needs a reboot and at the same time prevent the host from reconnecting every time there is a timeout?

Hi SJeane,
I apologize for taking so long to respond, but I wanted to test this on my end. In doing so, I realized that using the RT Reboot Controller.vi after the connection is lost does not work because the message to reboot cannot be relayed to the target without communication! Thus, to solve this problem, we have to approach it a different way. You mentioned that you tried programmatically clearing errors, but did you try to reestablish connection after clearing the errors? I tested this on my end with a FieldPoint controller, and the attached VIs resumed operation even after unplugging/replugging the Ethernet cable (no reboot). Will this solution work for you?
Peter K.
National Instruments
Attachments:
Reestablish.zip ‏39 KB

Envelope in real-time

Hi,
I want to calculate the envelope of the amplitude of a signal in real-time. Initial testing with the Hilbert transform has been unsatisfactory. I now square the signal, detect the maxima of the squared signal and do an interpolation on these maxima to recover the envelope of the signal. However, this results in an unacceptable delay of 1/2 signal period. How can reliably calculate the envelope a signal in real-time?
Best,
Michiel

Hello Michiel,
I see you tried to implement the Hilbert Transform.. DId you write this your self our did you try an example program? IBellow I put down a link to an example VI which does a Hilbert Transform. Did you see this VI before and does it also not do what you want to achief? The link:
http://zone.ni.com/devzone/cda/epd/p/id/1346
Regards,
RikP - National Instruments Applications Engineering
Rik Prins, CLD
Applications Engineering Specialist Northern Europe, National Instruments
Please tip your answer providers with kudos.
Any attached Code is provided As Is. It has not been tested or validated as a product, for use in a deployed application or system,
or for use in hazardous environments. You assume all risks for use of the Code and use of the Code is subject
to the Sample Code License Terms which can be found at: http://ni.com/samplecodelicense

Implementing real time networking into existing app

Its been some time since I have delved into the depths of networking. Hopefully someone can direct me in the right direction.
I have a desktop application with a MySQL backend. The application manages athletes, events, competitions etc for an athletics club. We can currently run the application on a machine hosting the MySQL database. From here we can connect a second machine with a separate instance of the application, connected to the MySQL database on the previous host machine.
Records can be simultaneously added or modified in parallel on both machines. Unfortunately if a record is created for example on the host machine A, machine B (connected to the MySQL database on host A via a network) does not detect this modification until machine B does an action to update the current screen. In which case the new record is visually shown.
What I would like to implement in the cleanest way into this current application is real time networking. So that when a record is updated on any machine connected to the host (including the host). That a signal is sent to each client connected to the host to update current contents in application if required.
What relevant material would you recommend I cover?
Would simple sockets do the trick?
All views welcomed
Mel

cotton.m wrote:
JMS? Thanks cotton, I will look into JMS
Unless you just wanted to play with sockets for the experience in which case you can do as you like. If you want get better with Java networking then IMO you must get ejp's book. [http://www.amazon.com/Fundamental-Networking-Java-Esmond-Pitt/dp/1846280303]
It's more of a fix before we release it to the poor souls that will be using our software, oh how the public are blind...
Mel

Replacing jar files real-time in classpath

Hi All
I have a swing application and It runs perfectly. I have created a update manager that can download jar files for the application. This update manager downloads jar files and replaces the jar files that are currently in the class path. You could say the update is real-time.
After the files are downloaded I get errors like class not found and other really strange Java errors. The class not found errors indicate that the application cant find classes that are in the downloaded jar file.
Is there any way to prevent this from happening?
Thanks in advance,
Martyn Hiemstra

I am currently just saving the downloaded files into the classpath directory, so in short I'm replacing them while the JVM is running.
The problem is that my Java application is installed using install4j meaning that the application is started as a .exe file. The problem is that I would need to create an external application to update the files but the external programme would have not idea where to put the newly downloaded files. T o overcome this all I want to create an updater within my own application.
Is there a way to shutdown real-time loading of jar files in the class path? That would solve the problem since the newly loaded jar files arent detected until the application is started again.

How to get the real-time data from a CCD camera in labview?

I am going to setup a monitor system and need to acquire the intensity of each pixel at each second from a CCD camera. Also, I need to to some simple calculations with these real-time data at every moment to get my finanl output in this monitor system.
How may I do this using Labview?
Thank you very much.
Kai

We don't have special powers, so we can't guess if you have Imaq Vision or not, if your camera comes with a LabVIEW driver, if it has an USB interface, or firewire, or a dedicated NI card, if you just want to detect a move, or a change in intensity, etc...
So, try to be more specific with your question, that will helps a lot
Chilly Charly (aka CC)
E-List Master - Kudos glutton - Press the yellow button on the left...

Trying to update channels in real time while controlling Agilent 34970a

Hello all,
I've gotten such valuable help on these forums and I am hoping that someone will be able to point me in the right direction with this issue. I'm still pretty new to LabVIEW so please bear with me.
I am working with the LabVIEW driver for the Agilent 34970A connected over a GPIB-ENET 100/1000. The device was detected and works just fine. The reason I am writing today is that I am trying to update the channel list in real time. Currently I need to stop the whole process in order to edit the channel list but due to the nature of the tests we will be performing it is important that I can add more channels as I go without interrupting the testing going on.
I've searched the forums and tried modifying the channel string control to "Update value while typing," and "Limit to single line." The motivation behind the latter change was so that I could modify the channel list and use the ENTER key to execute. I've also tried creating a while loop with shift registers but the construction ws so clumsy that it did not work either.
I am pretty sure that the modification should occur right at the string control but cannot be certain since the pint is for it to reinitialize what channels to scan and that occurs further down in the VI. I've attached the VI I am working with; it is an only slightly modified version of the driver's Advanced Scan Example.
Thank you all in advance,
Yusif
Solved!
Go to Solution.
Attachments:
HP34970A Advanced Scan Example_YN_5-16a-12.vi ‏77 KB

You may have added a shift register, but you're not actually comparing anything. You need to compare the value of the control to the value of the data coming from the shift register to see if it changed. If so, change the scan list.
If you need to have a delay after changing the scan list, then you should add the delay inside the case structure that calls the VI to reconfigure the scan list. You can use the Time Delay VI to cause the delay to occur after configuring the scan by using the error wires to force execution order.
P.S. Your naming scheme for VIs implies that you are probably not using a source code control system. If so, you would be well served in taking the time to learn about source code controls systems and installing one. It's very easy, and there have been numerous threads in the LabVIEW forum on recommendations of source code control systems.
Attachments:
changed.png ‏15 KB

Is vision development module in labview 8.6. sufficient for real-time image acquisition and analysis using a webcam

Hi,
I'm new to labview and trying to develop an eye-tracker using labview 8.6. It has the vision development module and i was wondering if this was sufficient for real-time image acquisition and processing or would i be needing any other software tools.
Solved!
Go to Solution.

Hello, certainly it is possible and sufficient for real-time tracking!
About eye tracking - if you need an example, you can find the code here:
https://decibel.ni.com/content/blogs/kl3m3n/2013/10/08/real-time-face-and-eye-detection-in-labview-u...
The code uses OpenCV functionalities along with the LabView UI (and some other functions like overlay).
Hope this helps a bit.
Best regards,
K
https://decibel.ni.com/content/blogs/kl3m3n
"Kudos: Users may give one another Kudos on the forums for posts that they found particularly helpful or insightful."

Real time threat detection

Similar Messages

Maybe you are looking for