Network › Module 2 › Lesson 2
Signatures Anomalies and Logs
A match is a pattern or a surprise — then grep YOUR bodies and logs.
Visual · ids_signatures_anomalies
Signatures match known shapes. Anomalies flag departures. Logs are the evidence. http://192.168.0.1/ YOUR lab.
Opening
A detector that cannot show its evidence is just a mood ring with a siren.
Lesson 1 split watch from block. This lesson splits how a watch decides. A signature says “this byte string / this URI / this header combo is a known bad or known interesting shape.” An anomaly says “this is unlike the baseline we claimed to know.” Both are only as honest as the log that survives: timestamp, dest YOU intended (here ), what matched, and what you did not do to strangers. Original Cyberlium. DEMO http://192.168.0.1/ is YOUR lab app.
1. Signatures are named shapes, not moral certainty
A signature is a claim: if this pattern appears, emit this alert id. It can be a path like /wp-login.php, a User-Agent token, a hex sequence, or a rate of 404s. The claim can be right, stale, or wildly too broad. “Matches SQL keyword” on YOUR teaching page that documents SQL is a signature doing what you told it — not proof of a break-in.
Cyberlium practice: write the pattern yourself against a body you retrieved from 127.0.0.1. That is literacy. Downloading someone else’s rule pack and firing it at a hotel LAN is not a lab, it is a mess with legal edges. first; if it is Router Admin, STOP.
Command guide
Signatures are named shapes, not moral certainty
═══ COMMANDS ═══
Command — copy this
printf '%s ' '/hit' 'User-Agent:' 'detect-only' > "$HOME/cyberlium-lab/t11-m02-sigs.txt"
2. Anomalies need a baseline you actually measured
Anomaly detection without a baseline is a poet: everything is surprising. A useful beginner baseline on YOUR toy is boring — typical path, typical size, typical status code for requests YOU send. A sudden extra path you did not curl is interesting only if you know what “usual” was.
Vendors sell “AI anomalies” that still need logs. You will count bytes and status codes from curl to You will not hping3 a neighbor to create a “volume anomaly,” and you will not scan /24 to invent a baseline of other people’s hosts.
Command guide
Anomalies need a baseline you actually measured
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install nmap
macOS:
Command — copy this
brew install nmap
Windows:
Command — copy this
choco install nmap # or download https://nmap.org/download.html
═══ COMMANDS ═══
Command — copy this
grep -F -f "$HOME/cyberlium-lab/t11-m02-sigs.txt" "$HOME/cyberlium-lab/t11-m02-l02.body" > "$HOME/cyberlium-lab/t11-m02-l02-hits.txt" grep -c . "$HOME/cyberlium-lab/t11-m02-l02-hits.txt" wc -c "$HOME/cyberlium-lab/t11-m02-l02.body"
3. Logs are the product; dashboards are optional paint
If you cannot answer when, where (), which pattern, and which verb (detect vs prevent), you do not have an IDS record — you have a screenshot. Append UTC timestamps. chmod 600. Do not paste other people’s packet captures into class chats.
A log that only says “SEVERE” teaches nothing at 2 a.m. A log that says “sig=/hit dest=code=200 verb=detect_only” is small and honest. Next lesson is why that honesty still produces false positives.
Command guide
Logs are the product; dashboards are optional paint
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
hits=$(grep -c . "$HOME/cyberlium-lab/t11-m02-l02-hits.txt" || echo 0)
python3 - << 'PY'
from pathlib import Path
p = Path.home() / "cyberlium-lab" / "t11-m02-l02-hits.txt"
lines = p.read_text(encoding="utf-8", errors="replace").splitlines() if p.exists() else []
print("unique_match_lines", len(set(lines)))
for row in sorted(set(lines))[:8]:
print("match:", row[:120])
PY4. What you ship: a pattern file, a baseline number, a log line you can read at 2 a.m.
Keep t11-m02-sigs.txt small and yours. Record status/bytes from Count signature hits in a body YOU fetched. No vendor dump onto a network you do not run. No LAN scans to “feed” anomalies.
5. What you record before the next lesson
Date. Signature vs anomaly one line each. DEMO GATE. SAFE sig_hits count. Files t11-m02-sigs.txt and t11-m02-l02-sigs-logs.txt chmod 600. NEVER nmap/sqlmap/ettercap.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
Load a huge public rule pack onto the school sensor. sqlmap a live site to “harvest signatures.” nmap the /24 so the anomaly engine has outliers.
Right
Write three patterns. Curl loopback. grep -f YOUR file. Log dest=Next: False Positives You Must Expect.
Mission: match YOUR patterns on YOUR loopback body
1) / STOP if router. 2) Write t11-m02-sigs.txt with at least two patterns. 3) curl , grep -f, count hits into the local alert log. Do not scan the LAN. Do not “train” on strangers.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor why grep -f on a body you own is a signature lab — not how to clone Snort onto a café mirror.
Knowledge Check
APPLY: Your teaching page documents the word SELECT and your signature is “SQL keyword.” A match fires. What is true?
Multiple choice
Knowledge Check
APPLY: True or False: Anomaly detection works well with no baseline of YOUR usual requests.
True or False
Knowledge Check
APPLY: curl http://192.168.0.1/ returns Netgear “Router Admin.” Signature lab next step?
Multiple choice