Intrusion Detection Systems Flashcards
What is an Intrusion Detection System (IDS)?
A security mechanism designed to detect unauthorized access, misuse, or attacks on a network or system.
What are the two main types of IDS?
- Host-Based IDS (HIDS): Monitors activity on individual devices.
- Network-Based IDS (NIDS): Monitors traffic across a network.
What are the primary functions of IDS?
Detecting malicious activity.
Logging details of detected incidents.
Alerting administrators to take action.
What is signature-based detection in IDS?
Detecting attacks by matching traffic against known attack patterns (signatures).
What is anomaly-based detection in IDS?
Identifying deviations from normal behavior to detect unknown attacks.
How does behavioral detection work in IDS?
Observes and profiles normal behavior patterns, triggering alerts when deviations occur.
How do rule-based alerts work in IDS?
Predefined rules trigger alerts when conditions are met, such as specific packet content or protocol violations.
Interpret the example rule:
alert ip $EXTERNAL_NET $SHELLCODE_PORTS -> $HOME_NET any
(msg:”SHELLCODE Linux shellcode”; content:”|90 90 90 E8 C0 FF FF FF|/bin/sh”; classtype:shellcode-detect; sid:652; rev:9;)
Detects Linux shellcode targeting the home network using a specific signature.
What are the main challenges faced by IDS?
High false-positive rates.
Inability to detect new threats without updated signatures.
Resource-intensive processing.
How can attackers evade IDS?
Packet fragmentation.
Encryption to hide payloads.
Flooding IDS with benign traffic to mask attacks.
What is a botnet?
A collection of compromised machines (bots) under the control of a botmaster, used for attacks like DDoS or spam.
How do botnets communicate?
Bots “phone home” to the C&C infrastructure for instructions and updates.
What is domain fluxing in botnets?
A technique where bots generate random domain names to find their C&C server, making detection and blocking harder.
How can ethical actors perform botnet takeovers?
Predict and register future C&C domains, intercepting bot communication without sending harmful commands.
What ethical guidelines should be followed during a botnet takeover?
Do no harm.
Avoid altering bot configurations.
Collaborate with ISPs and law enforcement.
