Intrusion Detection and Prevention Systems Flashcards
What is a Intrusion Detection System
Wire tap between the internal and External network
Can detect wide variety of intrusions
Presents analysis in simple format
Aims to block intrusions
What is monitored?
Network traffic
Users Resources
Command and program execution
read/write - execute some cmds
What are 2 intrusion detection processes?
Signature Based approach
Anomaly Based approach
What is Misuse Detection?
– What is bad, is known
– What is not bad, is good
Determines whether a sequence of instructions being executed is known to violate the security policy.
IDS matches data against a set of rules.
What is signature based detection?
– What is good, is known
– What is not good, is bad
What are Vulnerability based signatures?
Once a new vulnerability is disclosed, researchers develop signatures that anticipate the nature of yet-to-be-created threats
Specific based detection
what are good are included in the rules
If any deviations from the rules, IDS detects a potential intrusion.
What are Anomaly-based Approaches
– What is usual, is known
– What is unusual, is bad
What are Statistical Moments
Activity measures, CPU, I/O Process size
Pros/ Cons on Anomaly based
May detect zero-day attacks
Usually higher false positive rate
Pros/ Cons on Signature-based
Usually lower false positive rate
May not detect zero-day attacks
What is a honey pot
A system deployed to lure attackers
