4-4-4 Intrusion Detection and Prevention Explained

Key Concepts

• Intrusion Detection Systems (IDS)
• Intrusion Prevention Systems (IPS)
• Types of IDS/IPS
• Signature-Based Detection
• Anomaly-Based Detection
• Network-Based IDS/IPS
• Host-Based IDS/IPS

Intrusion Detection Systems (IDS)

An Intrusion Detection System (IDS) is a security tool that monitors network or system activities for malicious activities or policy violations. It collects and analyzes information from various areas within a computer or a network to identify possible security breaches.

Intrusion Prevention Systems (IPS)

An Intrusion Prevention System (IPS) is a security tool that not only monitors network or system activities for malicious activities but also takes action to prevent them. It can block or mitigate attacks in real-time.

Types of IDS/IPS

There are two main types of IDS/IPS:

• Network-Based IDS/IPS (NIDS/NIPS): Monitors network traffic for suspicious activity. It is typically deployed at strategic points within the network to monitor traffic to and from all devices on the network.
• Host-Based IDS/IPS (HIDS/HIPS): Monitors the activities of a single host for suspicious activity. It is installed on individual hosts and monitors the host's logs, file system, and system calls.

Signature-Based Detection

Signature-based detection involves comparing network traffic or system activities against a database of known attack patterns or signatures. If a match is found, the IDS/IPS triggers an alert or takes preventive action.

Anomaly-Based Detection

Anomaly-based detection involves creating a baseline of normal network or system behavior and then monitoring for deviations from this baseline. If an anomaly is detected, the IDS/IPS triggers an alert or takes preventive action.

Network-Based IDS/IPS (NIDS/NIPS)

Network-Based IDS/IPS (NIDS/NIPS) is deployed at strategic points within the network to monitor traffic to and from all devices on the network. It can detect attacks that originate from external networks as well as those that originate from within the network.

Host-Based IDS/IPS (HIDS/HIPS)

Host-Based IDS/IPS (HIDS/HIPS) is installed on individual hosts and monitors the host's logs, file system, and system calls. It can detect attacks that target specific hosts, such as malware infections or unauthorized access attempts.

Examples and Analogies

Think of an IDS as a security guard who monitors a building for suspicious activity. The guard (IDS) watches for known threats (signature-based detection) and unusual behavior (anomaly-based detection) and alerts the authorities if something is amiss.

An IPS is like a security guard who not only monitors the building but also takes action to prevent threats. If the guard (IPS) sees someone trying to break in, they can call the police (signature-based detection) or lock the doors if they notice unusual activity (anomaly-based detection).

A Network-Based IDS/IPS is like a security camera system that monitors the entire building (network) from a central location. It can detect threats from outside the building and inside the building.

A Host-Based IDS/IPS is like a security system installed in each room of the building (host). It monitors the activities in that specific room and can detect threats that target that room specifically.