Intrusion detection system

by 21:34 0 comments

                                Intrusion Detection System

By: Yash Pahuja, BCA 4th Sem, 1st Shift

Intrusion detection system is basically divided into two parts – Intrusion and detection system, where intrusion means to enter somewhere where someone is uninvited or not allowed to enter either physically or digitally and detection system is a system which detects such entries, this system can be a device or a software application.

What does an Intrusion Detection System (IDS) do?

An intrusion detection system detects entries from someone who don’t have permission to access somewhere or if some policies are violated, after detecting an intrusion this IDS reports to an administrator or security information and event management team which is sometimes abbreviated as SIEM.

How Intrusion Detection System is different from the firewall?

Though firewall and IDS both helps in securing the network, there is a big difference in both of them. A firewall is capable of detecting an intrusion only if the intrusion takes place from outside the system and an IDS is capable of detecting the intrusion even if someone tries to violate policies from inside the server.

IDS are classified on the basis of place that is intruded and the detection method that is used, let’s talk about some of the classifications. I wrote on the basis of place, place here refers to a network or a host, not a school or a park.

Network Intrusion Detection System (NIDS)

A NIDS keeps check on all the traffic that is passed through the network either it coming to the network or going from the network. It matches the traffic to the library of known attack and if and attack is observed, this system informs the administrator about the attack.

Host Intrusion Detection System (HIDS)

A HIDS work on an individual host or device of a network. It monitors all the coming and going traffic and keep taking the snapshots, then it compares new snapshot to the old one and if a change is made on some critical files, it alerts the administrator about that.

Physical Intrusion Detection System

I Physical IDS identifies the threat to the physical system, such system many times also acts as a prevention system as well as an IDS. Examples of such IDS are Security guards, security cameras etc.

Intrusion Prevention

Intrusion prevention system does the same work that is done by the intrusion detection system, in addition, they also try to prevent an attack or block the attack.

There are four types of intrusion prevention systems:

1. Network-based intrusion prevention system (NIPS)
2. Wireless intrusion prevention systems (WIPS)
3. Network behavior analysis (NBA)
4. Host-based intrusion prevention system (HIPS)

In today’s world intrusion detection system is a silver spoon that must be installed to enhance the security measures of a system or a network, with increasing threats increase the demands of security and IDS comes in action to fulfill those demands.