IDS - Intrusion Detection System

• Intrusion regarding the misuse of the system - these are the attacks carried out on the weak points of the system. That is, it is the attacks that exploit the system's vulnerabilities in order to misuse the system's functionalities. These attacks can be detected by monitoring the actions they take on assets to exploit their vulnerabilities;

• Intrusion as to the change of pattern - they are detected by monitoring the behavior of the network / system. Changes to previously established profiles are a sign of possible intrusion.

Having introduced the concept of intrusion, you can now explore the concepts of IDS.

IDS can be defined as software / hardware systems that automate the process of monitoring events that occur in computer systems, analyzing them based on signatures created from security problems (intrusions). This security mechanism basically serves to bring information about the network, such as, how many attack attempts (intrusion) were received per day and what type of attack was used.

According to Bace and Mell (2000), some aspects can be considered as motivators for the use of an IDS, as they can perform:

1. intimidation of users who seek to attack or misuse computer systems. The knowledge, on the part of those users, that the possibility of detecting attempts or attacks carried out can be a way of changing the behavior of those same users;

2. the detection of attacks and other types of security breaches that are not foreseen by other security mechanisms;

3. the existence of a documented history of the threats to the organization's information system with the organization;

4. acting as quality control for the project and the security administration, mainly in large and complex organizations;

5. improvements in the information on the intrusions that have occurred, which will serve as a reference to improve diagnostics, recovery and correction of existing failures.

Therefore, it can be concluded that the use of IDS will be one more mechanism which will help the organization that adopts them to know what is really going on in their network, helping them in decision making and activities to be carried out during or after a security incident in your information system.

Read More:    managed ids ips services

what is an intrusion detection system ?

There are different ways of trying to distinguish anomalous or malicious behavior, so different IDS system developers have addressed the problem in different ways. Although the solutions that we can find in the market usually include several of these forms of work, they have traditionally been categorized as follows:

Signature-based detection: This system attempts to locate a previously known chain of information in a communication. Thus, the system analyzes http traffic for request strings that induce a possible SQL Injection attack. The main advantage of this strategy is its high efficiency to detect attacks already known but, as a counterpart, it is practically useless to detect attacks not yet known by the system.

Policy-based detection: This system requires a thorough definition of the type of communication (and not just ports and protocol) between servers or different networks. These are very effective systems that require detailed configuration.

Detection based on anomalies: These systems seek to detect abnormal behaviors in our systems. The main difficulty is defining what is normal and what is not. There are currently two ways to try to register malicious changes:

Statistical detection of abnormalities: The systems analyze the behavior of our network or servers during a certain time. With this information they generate a pattern. When the behavior differs too much from the previously calculated normal pattern, the alarms jump and generate the relevant warnings or actions.

Non-statistical detection of abnormalities: In these teams it is an administrator who defines the normal behavior patterns so they can be very granular and specific although it is very possible that over time false positives will be generated.

 More info:    ids security