6-3 Intrusion Detection and Prevention Systems (IDS/IPS) Explained

Key Concepts

• Intrusion Detection System (IDS)
• Intrusion Prevention System (IPS)
• Signature-Based Detection
• Anomaly-Based Detection
• Network-Based IDS/IPS
• Host-Based IDS/IPS

Intrusion Detection System (IDS)

An Intrusion Detection System (IDS) is a security technology that monitors network or system activities for malicious activities or policy violations. IDS systems analyze network traffic and system logs to detect suspicious behavior. Once an intrusion is detected, the IDS generates an alert to notify administrators, but it does not take any action to prevent the intrusion.

Intrusion Prevention System (IPS)

An Intrusion Prevention System (IPS) is a security technology that not only monitors network or system activities but also takes proactive measures to prevent intrusions. IPS systems can block or mitigate attacks by dropping malicious packets, resetting connections, or taking other corrective actions. IPS is often deployed inline with the network traffic, allowing it to actively intervene in real-time.

Signature-Based Detection

Signature-Based Detection is a method used by IDS/IPS systems to identify known threats by comparing network traffic or system activities against a database of known attack signatures. These signatures are patterns or characteristics of known malicious activities. Signature-based detection is effective against known threats but may miss new or unknown threats that do not match any existing signatures.

Anomaly-Based Detection

Anomaly-Based Detection is a method used by IDS/IPS systems to identify potential threats by detecting deviations from normal behavior. This method involves creating a baseline of normal network or system activity and then monitoring for any deviations from this baseline. Anomaly-based detection can identify new or unknown threats but may generate false positives if the baseline is not accurately defined.

Network-Based IDS/IPS

Network-Based IDS/IPS systems monitor network traffic to detect and prevent intrusions. These systems are typically deployed on network segments or at critical points in the network, such as firewalls or routers. Network-based IDS/IPS can monitor all traffic passing through the network segment, providing comprehensive coverage for detecting and preventing network-based attacks.

Host-Based IDS/IPS

Host-Based IDS/IPS systems monitor activities on individual hosts, such as servers or workstations, to detect and prevent intrusions. These systems analyze system logs, file integrity, and process activities to identify suspicious behavior. Host-based IDS/IPS provide detailed insights into the security status of individual hosts and can detect attacks that originate from within the host or target the host specifically.

Examples and Analogies

Consider a large office building where an Intrusion Detection System (IDS) is like a security guard who monitors the building's security cameras and logs for any suspicious activities. If the guard sees something unusual, they notify the building manager (administrator) but do not take any action to stop the activity.

An Intrusion Prevention System (IPS) is like a security guard who not only monitors the building but also has the authority to take immediate action, such as calling the police or blocking an unauthorized entry. The guard can prevent intrusions in real-time by intervening directly.

Signature-Based Detection is like a security system that uses a database of known threats (e.g., known criminals' faces) to identify intruders. If the system recognizes a known threat, it alerts the guard. However, it may miss new threats that are not in the database.

Anomaly-Based Detection is like a security system that learns the normal behavior of the building (e.g., typical patterns of movement) and alerts the guard if anything deviates from this norm. This system can detect new threats but may also raise false alarms if the normal behavior is not accurately defined.

Network-Based IDS/IPS is like a security system that monitors all traffic entering and leaving the building, providing comprehensive coverage for detecting and preventing intrusions. Host-Based IDS/IPS is like a security system installed in each office, monitoring activities within the office and providing detailed insights into the security status of each room.