Revision as of 16:02, 1 December 2021 edit 82.9.102.240 (talk) →Encoding ← Previous edit		Revision as of 16:02, 1 December 2021 edit undo 82.9.102.240 (talk) →Operator fatigue Next edit →
Line 51: ===Operator fatigue=== Alerts generated by an IDS have to be acted upon in order for them to have any value. An attacker can reduce the "availability" of an IDS by overwhelming the human operator with an inordinate number of alerts by sending large amounts of "malicious" traffic intended to generate alerts on the IDS. The attacker can then perform the actual attack using the alert noise as cover. The tools 'stick' and 'snot' were designed for this purpose. They generate a large number of IDS alerts by sending attack ~~signatures~~signature across the network, but will not trigger alerts in IDS that maintain application protocol context. == References ==

Intrusion detection system evasion techniques: Difference between revisions