IDS - Intrusion Detection Systems

Let's learn today on IDS - Intrusion Detection Systems: ‪‎isoeh‬

NIDS vs HIDS

• Host-based IDS

An agent on a host identifying intrusions by analyzing system calls, application logs, file-system modifications (binaries, password files, capability databases, Access control lists, etc.) and other host activities and state.

In a HIDS, sensors usually consist of a software agent. Some application-based IDS are also part of this category. An example of a HIDS is OSSEC.

• Network NIDS

Platform identifying intrusions by examining network traffic and monitors multiple hosts.

• Gain access to network traffic by connecting to a network devices for port mirroring, or a network tap.

Placement:

• Sensors are placed at choke points in the network to monitor,in the demilitarized zone (DMZ) or at network borders.

PIDS vs VMDS

• Perimeter IDS
• Detects & pinpoints location of intrusion attempts on perimeter fences of critical infrastructures
• Electronics or advanced fiber optic cable technology in perimeter fence,for detection of disturbances on the fence
• VM based IDS

Detect intrusions using virtual machine monitoring.

Tweet

Share