Antispyd http://antispyd.sourceforge.net Antispyd, an Open-Source web threat filtering solution en Fri, 28 Oct 2005 20:12:53 +0200 http://blogs.law.harvard.edu/tech/rss jnm42@users.sourceforge.net jnm42@users.sourceforge.net computer security proxy server unix system-administration 1440 http://antispyd.sourceforge.net/images/logo-small.jpg Antispyd, an Open-Source web threat filtering solution http://antispyd.sourceforge.net objectives of antispyd-0.1 http://antispyd.sourceforge.net Julien I wish to provide a first stable release for this version, so I need HELP !!!  
 
Please send me bug notifications and wishlist for the future of this project. 
 
Moreover, I wish to provide a first list of signature of known web threats, so I need your participation too !!! 
 
Thank you in advance :) ]]> antispyd-0.0.9 released http://antispyd.sourceforge.net Julien This release provides a major improvement of the signature based filtering engine ( the BLOCK_SIGN filter), term of performance and functionnality. 
 
The signatures are now stored in a 3-Tree to enhance the matching of each HTTP message. 
 
Morevorer, this filtering can now be performed on each HTTP message content. 
 
Finally, a signature can now use hexadecimal array of byte to specify a field's value. 
 
For more informations ans samples,  see the man page :) ]]> objectives of antispyd-0.0.9 http://antispyd.sourceforge.net Julien  
- Speed up the signature checking : 
 
The signatures will be stored in a 3-Tree to drastically reduce the number of test to perform for each HTTP message. 
 
- Enhance the signature definition: 
 
A signature will be composed of 3 definition parameters : "url", "fld", "content" and an optional parameter "shape", to allow admins to specify what action to perform when a signature is matched.   Moreover, It will be possible to specify hexadecimal characters in the 3 definition fields of a signature. 
 
Another purpose of this release will be the improvement of the shellcode detection algorithm. Primarily, the objective is to effectively support shellcodes detection in hexa-encoded URLs.]]> antispyd-0.0.8 released http://antispyd.sourceforge.net Julien  This release contains two aspects :  
 
- the capability of inter-connection with others HTTP cache and proxy, via a new configuration directive : "cache_peer" (I know you know it :) ) and "direct_connect" directive for fault tolerance. 
 
- An HTTP engine acceleration, by the use of the N-Tree algorithm, for HTTP header fast reconnaissance.]]> antispyd-0.0.7 released http://antispyd.sourceforge.net Julien  This release provides 2 new features : 
 
- Domain White-List configuration 
- BLOCK_SIZE filter.  
 
The BLOCK_SIZE filter provides the ability to perform a control of incoming and outcoming traffic for wished mime types based on HTTP message size. The control configuration can be different for incoming and outcoming traffic. 
 
This control is performed with two independant technics : "HTTP header checking" and "HTTP flow tracking".  
 
The second possibility allows to monitor the HTTP message size during its transition throught the proxy. So, file's size can be controled even if the HTTP "content-size" header isn't present. This second method is disactivable via the configuration page. 
 
Moreover, filter management software architecture has been clean up. 
 
For more information, see the man page :) 

]]> objectives of antispyd-0.0.7 http://antispyd.sourceforge.net jnm42@users.sourceforge.net Two main objectives :

 - Improve the filter's internal architecture and speedup filtering.

 - Adding at least one filter : the BLOCK_SIZE filter, that will allows administrators to perform a filtering based on the couple (file type / file size).

]]> antispyd-0.0.6 released http://prdownloads.sourceforge.net/antispyd/antispyd-0.0.6.tar.gz?download jnm42@users.sourceforge.net  
And a better keep-alive processing has been developed to speed up HTTP flow transition. ]]> Antispyd RSS feed created :) jnm42@users.sourceforge.net This feed has been created for two main reasons, allowing peoples who are interested by antispyd to be fastly informed of new versions and permit me (the author of antispyd) to inform about the project, in term of design and features choices.

]]>