CYS406 · Chapter 12 · Annotated SlidesIntrusion Detection and Prevention Systems
Original
Overview

Intrusion Detection and Prevention Systems

How an IDS works and what it can and can’t do, indications of intrusion, IDS classifications (signature vs. anomaly, active vs. passive, network vs. host), IDS components, deployment, alert types (true/false positives and negatives), choosing an IDS/IPS, and Snort.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 40 slides
  1. 1 Module Flow
  2. 2 Intrusion Detection and Prevention System (IDS/IPS)
  3. 3 How does an IDS Work?
  4. 4 Role of an IDS in Network Defense
  5. 5 How an IDS Detects an Intrusion?
  6. 6 IDS Capabilities
  7. 7 IDS/IPS Limitations: What an IDS/IPS is NOT?
  8. 8 IDS/IPS Security Concerns
  9. 9 General Indications of Intrusions
  10. 10 IDS Classification
  11. 11 Approach-based IDS
  12. 12 Approach-based IDS (Cont’d)
  13. 13 Approach- based IDS (Cont’d)
  14. 14 Anomaly and Misuse Detection Systems
  15. 15 ❑ how it reacts to a potential intrusion
  16. 16 Protection-based IDS
  17. 17 An IDS is also classified as a centralized IDS or a distributed IDS , this classification is based on the structure of the IDS
  18. 18 Structure- based IDS (Cont’d)
  19. 19 Analysis Timing–based IDS
  20. 20 Source Data Analysis–based IDS
  21. 21 IDS Components
  22. 22 Network Sensors
  23. 23 Command Console
  24. 24 Alert Systems
  25. 25 Response System
  26. 26 Attack Signature Database
  27. 27 Collaboration of IDS Components in Intrusion Detection
  28. 28 Slide 28
  29. 29 Staged IDS Deployment
  30. 30 Deploying Network-based IDS
  31. 31 Deploying Network-based IDS (Cont’d)
  32. 32 Deploying Network- based IDS (Cont’d)
  33. 33 Deploying Network- based IDS (Cont’d)
  34. 34 Deploying a Host-based IDS
  35. 35 What is an IDS Alert?
  36. 36 Types of IDS
  37. 37 Characteristics of Good IDS Solutions
  38. 38 Selection of an Appropriate IDS/IPS Solutions
  39. 39 Intrusion Detection with Snort
  40. 40 Intrusion Detection Tools
Slide 1 / 40

Module Flow

Slide 1: Module Flow
Slide 2 / 40

Intrusion Detection and Prevention System (IDS/IPS)

Slide 2: Intrusion Detection and Prevention System (IDS/IPS)

Notes

  1. IDS detects and alerts (passive, out of band); IPS sits inline and can block.

Exam angle

PredictionQ1

The key difference between an IDS and an IPS is that an IPS:

Slide 3 / 40

How does an IDS Work?

Slide 3: How does an IDS Work?
Slide 4 / 40

Role of an IDS in Network Defense

Slide 4: Role of an IDS in Network Defense
Slide 5 / 40

How an IDS Detects an Intrusion?

Slide 5: How an IDS Detects an Intrusion?
Slide 6 / 40

IDS Capabilities

Slide 6: IDS Capabilities
Slide 7 / 40

IDS/IPS Limitations: What an IDS/IPS is NOT?

Slide 7: IDS/IPS Limitations: What an IDS/IPS is NOT?
Slide 8 / 40

IDS/IPS Security Concerns

Slide 8: IDS/IPS Security Concerns
Slide 9 / 40

General Indications of Intrusions

Slide 9: General Indications of Intrusions
Slide 10 / 40

IDS Classification

Slide 10: IDS Classification
Slide 11 / 40

Approach-based IDS

Slide 11: Approach-based IDS

Notes

  1. Signature (misuse) detection: matches known attack patterns. Low false positives; misses new (zero-day) attacks.

Slide 12 / 40

Approach-based IDS (Cont’d)

Slide 12: Approach-based IDS (Cont’d)
Slide 13 / 40

Approach- based IDS (Cont’d)

Slide 13: Approach- based IDS (Cont’d)

Notes

  1. Anomaly detection: learns normal behaviour and flags deviations. Can catch new attacks; more false positives.

  2. Memory trick Signature = known bad. Anomaly = not normal.

Exam angle

PredictionQ1

Which IDS approach can detect zero-day attacks?

Slide 14 / 40

Anomaly and Misuse Detection Systems

Slide 14: Anomaly and Misuse Detection Systems
Slide 15 / 40

❑ how it reacts to a potential intrusion

Slide 15: ❑ how it reacts to a potential intrusion
Slide 16 / 40

Protection-based IDS

Slide 16: Protection-based IDS
Slide 17 / 40

An IDS is also classified as a centralized IDS or a distributed IDS , this classification is based on the structure of the IDS

Slide 17: An IDS is also classified as a centralized IDS or a distributed IDS , this classification is based on the structure of the IDS

Notes

  1. NIDS monitors network traffic (sensors on segments); HIDS monitors one host (logs, files, system calls).

Exam angle

PredictionQ1

An IDS that monitors a server’s system files and logs is:

Slide 18 / 40

Structure- based IDS (Cont’d)

Slide 18: Structure- based IDS (Cont’d)
Slide 19 / 40

Analysis Timing–based IDS

Slide 19: Analysis Timing–based IDS
Slide 20 / 40

Source Data Analysis–based IDS

Slide 20: Source Data Analysis–based IDS
Slide 21 / 40

IDS Components

Slide 21: IDS Components
Slide 22 / 40

Network Sensors

Slide 22: Network Sensors
Slide 23 / 40

Command Console

Slide 23: Command Console
Slide 24 / 40

Alert Systems

Slide 24: Alert Systems
Slide 25 / 40

Response System

Slide 25: Response System
Slide 26 / 40

Attack Signature Database

Slide 26: Attack Signature Database
Slide 27 / 40

Collaboration of IDS Components in Intrusion Detection

Slide 27: Collaboration of IDS Components in Intrusion Detection
Slide 28 / 40

Slide 28

Slide 28: Slide 28
Slide 29 / 40

Staged IDS Deployment

Slide 29: Staged IDS Deployment
Slide 30 / 40

Deploying Network-based IDS

Slide 30: Deploying Network-based IDS
Slide 31 / 40

Deploying Network-based IDS (Cont’d)

Slide 31: Deploying Network-based IDS (Cont’d)
Slide 32 / 40

Deploying Network- based IDS (Cont’d)

Slide 32: Deploying Network- based IDS (Cont’d)
Slide 33 / 40

Deploying Network- based IDS (Cont’d)

Slide 33: Deploying Network- based IDS (Cont’d)
Slide 34 / 40

Deploying a Host-based IDS

Slide 34: Deploying a Host-based IDS
Slide 35 / 40

What is an IDS Alert?

Slide 35: What is an IDS Alert?
Slide 36 / 40

Types of IDS

Slide 36: Types of IDS

Exam angle

PredictionQ1

An IDS missing a real attack is a:

Slide 37 / 40

Characteristics of Good IDS Solutions

Slide 37: Characteristics of Good IDS Solutions
Slide 38 / 40

Selection of an Appropriate IDS/IPS Solutions

Slide 38: Selection of an Appropriate IDS/IPS Solutions
Slide 39 / 40

Intrusion Detection with Snort

Slide 39: Intrusion Detection with Snort

Notes

  1. Snort: open-source NIDS/IPS; rules: action protocol src_ip src_port -> dst_ip dst_port (options).

Slide 40 / 40

Intrusion Detection Tools

Slide 40: Intrusion Detection Tools