Sec 6.8 Intrusion Detection System (IDS)

VPN concentrator Protocol analyzer Host-based IDS A host-based IDS is installed on a single host and monitors all traffic coming in to the host. A host-based IDS can analyze encrypted traffic because the host operating system decrypts that traffic as it is received.

Network traffic External sensors Host system auditing capabilities A host-based IDS often relies upon the host system's auditing capabilities to perform detection activities. The host-based IDS uses the logs of the local system to search for attack or intrusion activities.

An alert is generated and delivered via email, the console, or an SNMP trap. The IDS logs all pertinent data about the intrusion. The IDS configuration is changed dynamically, and the source IP address is banned.

Application implementation flaws Buffer overflow exploitation of software Bandwidth-based denial of service Network-based intrusion detection systems are best suited to detect and prevent bandwidth-based denial of service attacks. This type of attack manipulates network traffic in such a way that network-based IDS can easily detect it.

Listening to network traffic Monitoring the audit trails on a server Transmitting FIN or RES packets to an external host Disconnecting a port being used by a zombie Passive IDS is a form of IDS that takes no noticeable action on the network. Passive IDS systems are undetectable by intruders. Passive IDS systems can monitor audit trails or listen to network traffic in real time.

Proxy DNS server IDS An intrusion detection system (IDS) is a special network device that can detect attacks and suspicious activity.

ACL VPN IDS IPS

False positive Positive False negative

The source address identifying a non-existent host Legitimate traffic being flagged as malicious Malicious traffic not being identified

IDS IPS Multi-layer switch intrusion prevention system (IPS) can detect and respond to security events. An IPS differs from an IDS because it can respond to security threats, not just detect them.

Packet sniffer IDS IPS

Buffer overflow exploitation of software Bandwidth-based denial of service Application implementation flaw

To delay intruders in order to gather auditing data To entrap intruders To prevent sensitive data from being accessed A honeypot is used to delay intruders in order to gather auditing data. A honeypot is a fake network or system that hosts false information but responds as a real system should. Honeypots usually entice intruders to spend considerable time on the system and allows extensive logging of the intruder's activities.

Implement a stateful firewall in front of the web server Implement an application-aware IPS in front of the web server Implement an application-aware IDS in front of the web server Install an anti-malware scanner on the web server

The system identified harmful traffic as harmless and allowed it to pass without generating any alerts. The system correctly deemed harmless traffic as inoffensive and let it pass. The system detected a valid attack and the appropriate alarms and notifications were generated.