Unit-3
Intrusion Detection System(IDS)
Dr. K . Rajender
Assistant Professor
Dept. of Commerce, UPGCS
Intrusion Detection System(IDS)
• An IDS (Intrusion Detection System)
monitors the traffic on a computer
network to detect any suspicious
activity.
• It analyzes the data flowing through
the network to look for patterns and
signs of abnormal behavior.
• The IDS compares the network activity to a set
of predefined rules and patterns to identify
any activity that might indicate an attack or
intrusion.
• If the IDS detects something that matches one
of these rules or patterns, it sends an alert to
the system administrator.
• The system administrator can then investigate
the alert and take action to prevent any
damage or further intrusion.
Intrusion Detection System are 5 types:
1. Network Intrusion Detection System (NIDS):
Network intrusion detection systems (NIDS) are
set up at a planned point within the network
to examine traffic from all devices on the
network.
It performs an observation of passing traffic on
the entire subnet and matches the traffic
that is passed on the subnets to the
collection of known attacks.
2. Host Intrusion Detection System (HIDS):
• Host intrusion detection systems (HIDS) run
on independent hosts or devices on the
network.
• A HIDS monitors the incoming and outgoing
packets from the device only and will alert the
administrator if suspicious or malicious
activity is detected.
• It takes a snapshot of existing system files and
compares it with the previous snapshot.
3. Protocol-based Intrusion Detection System
(PIDS)
• Protocol-based intrusion detection
system (PIDS) comprises a system or
agent that would consistently reside
at the front end of a server,
controlling and interpreting the
protocol between a user/device and
the server.
4. Application Protocol-based
Intrusion Detection System (APIDS):
• An application Protocol-based Intrusion
Detection System (APIDS) is a system or
agent that generally resides within a
group of servers.
• It identifies the intrusions by monitoring
and interpreting the communication on
application-specific protocols.
5. Hybrid Intrusion Detection System:
• Hybrid intrusion detection system is
made by the combination of two or more
approaches to the intrusion detection
system.
• In the hybrid intrusion detection system,
the host agent or system data is
combined with network information to
develop a complete view of the network
system.
