Intrusion detections systems – an outmoded network protection model

Abstract

Intrusion detection systems (IDS) are a common component of computer network defences, but their cost usually outweighs their effectiveness and they give a false sense of security says this article. They attempt to detect malicious activity, but were designed when firewalls were at an earlier stage in their development and use techniques - signatures and noise - which generate resource-consuming false positives. IDS systems are cumbersome, merely reactive, and entail high, often hidden and unnecessary costs for industry, but are often retained because bizarrely they meet auditing requirements. With current technology, the way forward is with intrusion protection pystems (IPS) which are less expensive, preventative and much more sensitive to context and traffic patterns. Intrusion detection systems have become almost a standard element of most modern computer network defence in-depth solutions, but are they really worth their weight in bureaucracy?