Scribd Logo
Upload

Welcome to Scribd!

  • 20 views

    Intrusion Detection Systems: Submitted by

    Uploaded by

    Hradyesh Pathak
    This document discusses intrusion detection systems (IDS). It provides an overview of IDS, including that IDS detects inappropriate or malicious activity on computer networks. There are two main types of IDS: network based IDS which examines network traffic to monitor multiple hosts, and host based IDS which analyzes system activities and state within individual hosts. The document also notes some disadvantages of IDS such as potential false alarms, needing frequent signature updates, and slow processing.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd
    Flag for inappropriate content

    You might also like

    Intrusion Detection Systems: Submitted by

    Uploaded by

    Hradyesh Pathak
    20 views19 pages
    This document discusses intrusion detection systems (IDS). It provides an overview of IDS, including that IDS detects inappropriate or malicious activity on computer networks. There are two main types of IDS: network based IDS which examines network traffic to monitor multiple hosts, and host based IDS which analyzes system activities and state within individual hosts. The document also notes some disadvantages of IDS such as potential false alarms, needing frequent signature updates, and slow processing.

    Original Description:

    Original Title

    final as

    Copyright

    © Attribution Non-Commercial (BY-NC)

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    This document discusses intrusion detection systems (IDS). It provides an overview of IDS, including that IDS detects inappropriate or malicious activity on computer networks. There are two main types of IDS: network based IDS which examines network traffic to monitor multiple hosts, and host based IDS which analyzes system activities and state within individual hosts. The document also notes some disadvantages of IDS such as potential false alarms, needing frequent signature updates, and slow processing.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pptx, pdf, or txt
    20 views19 pages

    Intrusion Detection Systems: Submitted by

    Uploaded by

    Hradyesh Pathak
    This document discusses intrusion detection systems (IDS). It provides an overview of IDS, including that IDS detects inappropriate or malicious activity on computer networks. There are two main types of IDS: network based IDS which examines network traffic to monitor multiple hosts, and host based IDS which analyzes system activities and state within individual hosts. The document also notes some disadvantages of IDS such as potential false alarms, needing frequent signature updates, and slow processing.

    Copyright:

    Attribution Non-Commercial (BY-NC)
    Download as PPTX, PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pptx, pdf, or txt
    of 19

    Intrusion Detection Systems

    Submitted by
    Hradayesh pathak
    CONTENT
    Network Security System
    Fire wall
    Introduction
     Development
    Type of IDS
    CONTENT
    Technology
    Disadvantage
    Conclusion
    network Security System
    Fire wall
    A firewall is a part of a computer system or
    network that is designed to block
    unauthorized access while permitting
    authorized communications
    Introduction

    Intrusion Detection System


    Meaning of IDS – “Intrusion Detection
    System”, is a security system that detects
    inappropriate or malicious activity on a
    computer or network.
    Functioning of IDs
    Audit Records
    system activities are
    observable
    Audit Data
    Preprocessor

    Activity Data

    Detection normal and intrusive


    Detection Engine activities have distinct
    Models
    evidence
    Alarms
    Action/Report
    Decision Decision Engine
    Table
    Development

    In 1984 -
    Type of IDS
     Network Based IDS

     Host Based IDS


    Network Based IDS

     An independent platform that identifies


    intrusions by examining network traffic and
    monitors multiple hosts.
    e.g.-snort.
    Host Based IDS

    It consists of an agent on a host that identifies


    intrusions by analyzing system calls, application logs,
    file-system modifications and other host activities and
    state.
    E.g.-ossec
    Network Based IDSs
    Internet Gateway routers

    Our network

    Host based
    detection

     At the early stage of the worm, only limited worm


    samples.
     Host based sensors can only cover limited IP space,
    which might have scalability issues. Thus they might not
    be able to detect the worm in its early stage
    Detection Technology

    Signature detection

    Anomaly detection
    Signature Detection
    pattern
    matching

    Intrusion intrusion
    Patterns

    activities

    Example: if (src_ip == dst_ip) then “land attack”

    Can’t detect new attacks


    Anomaly Detection
    90
    80 probable
    70 intrusion
    60
    activity 50
    measures40 normal profile
    30 abnormal
    20
    10
    0
    CPU Process
    Any problem ? Size

    Relatively high false positive rate


    • Anomalies can just be new normal activities.
    • Anomalies caused by other element faults
    • E.g., router failure or misconfiguration, P2P
    misconfiguration
    Disadvantage
    False alarm

    Signature updates

    Slow processing
    Conclusion
    We have a good fire wall so why we
    need intrusion detection
    system…………….?
    REFERENCES
    www.wikipedia.com
    www.ieee.org
    www.juhuj.com
    Thank you!

    CSE 597E Fall 2001 PennState University 19

    You might also like