[Owasp-appsensor-project] GeoIP Data

[Ryan Barnett]

Hello everyone,
Not sure if this is a new detection point or perhaps an update to an
existing one ­ tracking GeoIP data during a Session.  See my recent blog
post on using this data -
http://blog.modsecurity.org/2010/10/detecting-malice-with-modsecurity-geoloc
ation-data.html

The concept is similar to the current Session Exception -
http://www.owasp.org/index.php/AppSensor_DetectionPoints#SE5:_Source_IP_Addr
ess_Changes_During_Session

While this is somewhat similar to Source IP Changes During Session ­ it is a
bit more lenient as you could track by City/State/Country.

Perhaps a title change to ­ Source Location Changes During Session.  This
would allow for either GeoIP or IP Address data to be evaluated.

-Ryan



-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.owasp.org/pipermail/owasp-appsensor-project/attachments/20101101/afe1ea21/attachment.html