Intrusion

Detection
System
BY:
Krishna Nandan Kumar
2SD12CS044

Content
Introduction
How does ids work?
Types of ids
o Network Intrusion Detection System
o Host intrusion Detection System
o HDIS vs NDIS

IDS Technique
Firewall vs IDS
Benefit of IDS
limitations

Introduction
Unauthorized attempt to
o Access information
o Manipulate information
o Render a system unreliable or unusable

Detect possible intrusion

Inspect inbound and outbound activities

How does ids work?

Serve essential functionality
Send alert

Network Intrusion
Detection System
Monitor traffic on the network system
Placed at strategic point or point within network
to monitor
Consist of single-purpose sensor

Host Based Intrusion

detection system
Pieces of software on the system to be monitored
Check integrity of our system file
Monitor activities from the system only

HIDS vs NIDS
Unauthorised outsider access
Bandwidth theft /denial of service
Traffic monitors

Misuse Detection
Also termed as signature based
Monitor and analyze traffic against predefined
attack
Should be updated regularly
compare packet against database of signatures
or attributes from known malicious threats

Advantages
Effective in detecting attack without generating
false attack
Quickly and reliably diagnose the use of tool and
technique
Allow susytem manager to track security problem

Behaviour based IDS

Observe deviation in behavior of user
If deviation observed ,alarm is generated
ADVANTAGES
o Ability to detect symptoms of attack without specific knowledge of
details
o Detect attempt to exlpoit new and unforeseen vulnerabilities
o Define signature for misuse attack

Firewall vs IDS
Firewall cannot detect security breaches
associated with traffic that does not pass through
it.
Not all the access to the internet through the
firewall
Does not inspect the content of permitted traffic
More often to be attacked than IDS
Helpless under tunneling attack

Benefit of IDS
Monitors the operation of firewalls, routers, key
management servers and files critical to other
security mechanisms.
Allows administrator to tune, organize and
comprehend often incomprehensible operating
system audit trails and other logs.
Can recognize and report alterations to data files.
IDS generate alarm and report to administrator
that security is breaches and also react to
intruders by blocking them or blocking server.

Limitations
Cannot conduct investigations of attacks without human
intervention.
Cannot understand the contents of your organizational
security policy.
Cannot compensate for weaknesses in network
protocols.
Cannot compensate for weak identification and
authentication mechanisms.
Capable of monitoring network traffic but to a certain
extent of traffic level.
It can neither tell you exactly who and how the attack
occurred nor the intention of the attacker.

Thank you