|
IPS/IDS 
|
|
|
|
An Intrusion Prevention System is a network security device that monitors
network and/or system activities for malicious or unwanted behaviour and
can react, in real-time, to block or prevent those activities. IPS can make
access control decisions based on application content, rather than IP address
or ports as traditional
firewalls had done. However, in order to
improve performance and accuracy of classification mapping, most IPS use
destination port in their signature format. As IPS systems were originally
a literal extension of intrusion detection systems, they continue to be related
Intrusion prevention systems may also serve secondarily at the host level to
deny potentially malicious activity. There are advantages and disadvantages to
host-based IPS compared with network-based IPS. In many cases, the technologies
are thought to be complementary.
An Intrusion detection system (IDS) is software and/or hardware
designed to detect unwanted attempts at accessing, manipulating,
and/or disabling of computer systems, mainly through a network, such as
the Internet. These attempts may take the form of attacks, as examples,
by crackers,
malware and/or disgruntled employees.
An IDS cannot directly
detect attacks within properly encrypted traffic.
An intrusion detection system is used to detect several types of malicious
behaviours that can compromise the security and trust of a computer system.
This includes network attacks against vulnerable services, data driven attacks on
applications, host based attacks such as privilege escalation, unauthorized logins
and access to sensitive
Types of Intrusion-Detection systems
• A network intrusion detection system (NIDS).
• A protocol-based intrusion detection system
• An application protocol-based intrusion detection system (APIDS) specific to the middleware/business logic as it transacts with the database.
• A host-based intrusion detection system (HIDS) consists of an agent on a host which identifies intrusions by analyzing system calls, application logs, file-system modifications (binaries, password files, capability/acl databases) and other host activities and state. An example of a HIDS is OSSEC.
• A hybrid intrusion detection system combines two or more approaches. Host agent data is combined with network information to form a comprehensive view of the network. An example of a Hybrid IDS is Prelude.
|
|