Chapter 4 - Introduction to Intrusion Detection Systems

Abstract

This chapter provides an introduction to intrusion detection system (IDS). IDS is the high-tech equivalent of a burglar alarm—a burglar alarm configured to monitor access points, hostile activities, and known intruders. IDS is a specialized tool that knows how to read and interpret the contents of log files from routers, firewalls, servers, and other network devices. An IDS often stores a database of known attack signatures and can compare patterns of activity, traffic, or behavior it sees in the logs it is monitoring against those signatures to recognize when a close match between a signature and current or recent behavior occurs. At that point, the IDS can issue alarms or alerts, take various kinds of automatic action ranging from shutting down Internet links or specific servers to launching back traces, and make other active attempts to identify attackers and actively collect evidence of their nefarious activities. IDSs can be software based or can combine hardware and software (in the form of preinstalled and preconfigured stand-alone IDS devices). Often, IDS software runs on the same devices or servers where firewalls, proxies, or other boundary services operate; an IDS not running on the same device or server where the firewall or other services are installed monitors those devices closely and carefully. Although such devices tend to operate at network peripheries, IDSs can detect and deal with insider attacks as well as external attacks.