-
Intrusion Defense System
-
Integrated Delivery System
-
Integrated Deterrence System
-
Intrusion Detection System
EXPLANATION
An
Intrusion Detection System (IDS) is a system that monitors
network traffic
for suspicious activity and issues alerts when such activity is
discovered. It is a software application that scans a network or a
system for harmful activity or policy breaching. Any malicious venture
or violation is normally reported either to an administrator or
collected centrally using a security information and event management
(SIEM) system. A SIEM system integrates outputs from multiple sources
and uses alarm filtering techniques to differentiate malicious activity
from false alarms.
Although intrusion detection systems monitor networks for potentially
malicious activity, they are also disposed to false alarms. Hence,
organizations need to fine-tune their IDS products when they first
install them. It means properly setting up the intrusion detection
systems to recognize what normal traffic on the network looks like as
compared to malicious activity.
Intrusion prevention systems also monitor network packets inbound the
system to check the malicious activities involved in it and at once
sends the warning notifications.
Classification of Intrusion Detection System:
IDS is basically classified into 2 types:
- Network Intrusion Detection System (NIDS):
Network intrusion detection systems (NIDS) are set up at a planned point
within the network to examine traffic from all devices on the network.
It performs an observation of passing traffic on the entire subnet and
matches the traffic that is passed on the subnetts to the collection of
known attacks. Once an attack is identified or abnormal behavior is
observed, the alert can be sent to the administrator. An example of an
NIDS is installing it on the subnet where firewalls are located in order
to see if someone is trying crack the firewall.
- Host Intrusion Detection System (HIDS):
Host intrusion detection systems (HIDS) run on independent hosts or
devices on the network. A HIDS monitors the incoming and outgoing
packets from the device only and will alert the administrator if
suspicious or malicious activity is detected. It takes a snapshot of
existing system files and compares it with the previous snapshot. If the
analytical system files were edited or deleted, an alert is sent to the
administrator to investigate. Anexample of HIDS usage can be seen on
mission critical machines, which are not expected to change their
layout.
Detection Method of IDS:
- Signature-based Method:
Signature-based IDS detects the attacks on the basis of the specific
patterns such as number of bytes or number of 1’s or number of 0’s in
the network traffic. It also detects on the basis of the already known
malicious instruction sequence that is used by the malware. The detected
patterns in the IDS are known as signatures.
Signature-based IDS can easily detect the attacks whose pattern
(signature) already exists in system but it is quite difficult to detect
the new malware attacks as their pattern (signature) is not known.
- Anomaly-based Method:
Anomaly-based IDS was introduced to detect the unknown malware attacks
as new malware are developed rapidly. In anomaly-based IDS there is use
of machine learning to create a trustful activity model and anything
coming is compared with that model and it is declared suspicious if it
is not found in model. Machine learning based method has a better
generalized property in comparison to signature-based IDS as these
models can be trained according to the applications and hardware
configurations.
Comparison of IDS with Firewalls:
IDS and firewall both are related to the network security but an IDS
differs from a firewall as a firewall looks outwardly for intrusions in
order to stop them from happening. Firewalls restrict access between
networks to prevent intrusion and if an attack is from inside the
network it don’t signal. An IDS describes a suspected intrusion once it
has happened and then signals an alarm.