Intrusion Detection System

Intrusion Detection System

Introduction:

The Internet is a global public network. With the growth of the Internet and its potential, there has been a subsequent change in the business model of organizations across the world. More and more people are getting connected to the Internet every day to take advantage of the new business model popularly known as e-Business. Internetwork connectivity has, therefore, become a very critical aspect of today's e_business.

There are two sides of business on the Internet. On one side, the Internet brings in tremendous potential to business in terms of reaching the end users. At the same time, it also brings in a lot of risk to the business. There are both harmless and harmful users on the Internet. While

To put it in simpler terms, an Intrusion detection system can be compared with a burglar alarm. For example, the lock system in a car protects the car from theft. But if somebody breaks the lock system and tries to steal the car, it is the burglar alarm that detects that the lock has been broken and alerts the owner by raising an alarm.

The Intrusion detection system in a similar way complements the firewall security. The firewall protects an organization from malicious attacks from the Internet and the Intrusion detection system detects if someone tries to break in through the firewall or manages to break in the firewall security and tries to have access to any system in the trusted side and alerts the system administrator in case there is a breach in security.

Moreover, Firewalls do a very good job of filtering incoming traffic from the Internet; however, there are ways to circumvent the firewall. For example, external users can connect to the Intranet by dialing in through a modem installed in the private network of the organization. This kind of access would not be seen by the

These are host-based Intrusion Detection System and network-based Intrusion Detection System. A Host-based Intrusion Detection system has only host-based sensors and a network-based Intrusion detection system has a network-based sensor as explained in the Picture1 below.

As shown in the picture1, a network-based IDS sensor has two interfaces. One of the interfaces is manageable. The IDS management console communicates with the sensor through the management interface. The other interface of the IDS is in promiscuous (listening) mode. This interface cannot be accessed over the network and is not manageable.

The monitoring interface is connected to the network segment, which is being monitored. The sensor examines every packet that crosses the network segment. Network-based sensors apply predefined attack signatures to each frame to identify hostile traffic. If it finds a match against any signature, it notifies the management console. Some vendors offer network-based sensors running off a workstation. Some vendors offer sensor appliances with the proprietary operating system and sensor software.

Advantages of Network-based Intrusion Detection