Valuable property needs to be protected from the prospect of
theft and destruction. Some homes are equipped with alarm systems
that can deter burglars, notify authorities when a break-in has
occurred, and even warn owners when their home is on fire. Such
measures are necessary to ensure the integrity of homes and the
safety of homeowners.
The same assurance of integrity and safety should also be
applied to computer systems and data. The Internet has facilitated
the flow of information, from personal to financial. At the same
time, it has fostered just as many dangers. Malicious users and
crackers seek vulnerable targets such as unpatched systems, systems
infected with trojans, and networks running insecure services.
Alarms are needed to notify administrators and security team
members that a breach has taken place so that they can respond in
real-time to the threat. Intrusion detection
systems have been designed as such a warning system.
An intrusion detection system (IDS) is an active process or
device that analyzes system and network activity for unauthorized
entry and/or malicious activity. The way that an IDS detects
anomalies can vary widely; however, the ultimate aim of any IDS is
to catch perpetrators in the act before they do real damage to
resources.
An IDS protects a system from attack, misuse, and compromise. It
can also monitor network activity, audit network and system
configurations for vulnerabilities, analyze data integrity, and
more. Depending on the detection methods you choose to deploy,
there are several direct and incidental benefits to using an
IDS.
Understanding what an IDS is, and the functions it provides, is
key in determining what type is appropriate to include in a
computer security policy. This section discusses the concepts
behind IDSes, the functionalities of each type of IDS, and the
emergence of hybrid IDSes that employ several detection techniques
and tools in one package.
Some IDSes are knowledge-based, which
preemptively alert security administrators before an intrusion
occurs using a database of common attacks. Alternatively, there are
behavioral-based IDSes that track all
resource usage for anomalies, which is usually a positive sign of
malicious activity. Some IDSes are standalone services that work in
the background and passively listen for activity, logging any
suspicious packets from the outside. Others combine standard system
tools, modified configurations, and verbose logging, with
administrator intuition and experience to create a powerful
intrusion detection kit. Evaluating the many intrusion detection
techniques can assist in finding one that is right for your
organization.
The most common types of IDSes referred to in the security field
are known as host-based and network-based IDSes. A host-based IDS is the most
comprehensive of the two, which involves implementing a detection
system on each individual host. Regardless of which network
environment the host resides on, it is still protected. A
network-based IDS funnels packets through a single device before
being sent to specific hosts. Network-based IDSes are often
regarded as less comprehensive since many hosts in a mobile
environment make it unavailable for reliable network packet
screening and protection.
