Lecture-33 programming lacture notes.pptx
- 1. 1 Information Security Lecture # 33 Dr. Shafiq Hussain Associate Professor & Chairperson Department of Computer Science
- 2. 2 Objectives • Introduction to Intrusion Detection System.
- 3. 3 Intrusion Detection System • An Intrusion Detection System (IDS) is a security tool that monitors a computer network or systems for malicious activities or policy violations.
- 4. 4 Intrusion Detection System (Cont..) • It helps detect unauthorized access, potential threats, and abnormal activities by analyzing traffic and alerting administrators to take action. • An IDS is crucial for maintaining network security and protecting sensitive data from cyber-attacks.
- 5. 5 Intrusion Detection System (Cont..) • An Intrusion Detection System (IDS) maintains network traffic looks for unusual activity and sends alerts when it occurs.
- 6. 6 Intrusion Detection System (Cont..) • The main duties of an Intrusion Detection System (IDS) are anomaly detection and reporting, however, certain Intrusion Detection Systems can take action when malicious activity or unusual traffic is discovered.
- 7. 7 Intrusion Detection System (Cont..)
- 8. 8 Intrusion Detection System (Cont..) Working of Intrusion Detection System(IDS) • An IDS (Intrusion Detection System) monitors the traffic on a computer network to detect any suspicious activity. • It analyzes the data flowing through the network to look for patterns and signs of abnormal behavior.
- 9. 9 Intrusion Detection System (Cont..) Working of Intrusion Detection System(IDS) • The IDS compares the network activity to a set of predefined rules and patterns to identify any activity that might indicate an attack or intrusion.
- 10. 10 Intrusion Detection System (Cont..) Working of Intrusion Detection System(IDS) • If the IDS detects something that matches one of these rules or patterns, it sends an alert to the system administrator. • The system administrator can then investigate the alert and take action to prevent any damage or further intrusion.
- 11. 11 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Network Intrusion Detection System (NIDS): • Network intrusion detection systems (NIDS) are set up at a planned point within the network to examine traffic from all devices on the network.
- 12. 12 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Network Intrusion Detection System (NIDS): • It performs an observation of passing traffic on the entire subnet and matches the traffic that is passed on the subnets to the collection of known attacks.
- 13. 13 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Network Intrusion Detection System (NIDS): • Once an attack is identified or abnormal behavior is observed, the alert can be sent to the administrator. • An example of a NIDS is installing it on the subnet where firewalls are located in order to see if someone is trying to crack the firewall.
- 14. 14 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Host Intrusion Detection System (HIDS): • Host intrusion detection systems (HIDS) run on independent hosts or devices on the network.
- 15. 15 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Host Intrusion Detection System (HIDS): • A HIDS monitors the incoming and outgoing packets from the device only and will alert the administrator if suspicious or malicious activity is detected.
- 16. 16 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Host Intrusion Detection System (HIDS): • It takes a snapshot of existing system files and compares it with the previous snapshot.
- 17. 17 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Host Intrusion Detection System (HIDS): • If the analytical system files were edited or deleted, an alert is sent to the administrator to investigate. • An example of HIDS usage can be seen on mission- critical machines, which are not expected to change their layout.
- 18. 18 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Protocol-Based Intrusion Detection System (PIDS): • Protocol-based intrusion detection system (PIDS) comprises a system or agent that would consistently reside at the front end of a server, controlling and interpreting the protocol between a user/device and the server.
- 19. 19 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Protocol-Based Intrusion Detection System (PIDS): • It is trying to secure the web server by regularly monitoring the HTTPS protocol stream and accepting the related HTTP protocol.
- 20. 20 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Protocol-Based Intrusion Detection System (PIDS): • As HTTPS is unencrypted and before instantly entering its web presentation layer then this system would need to reside in this interface, between to use the HTTPS.
- 21. 21 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Application Protocol-Based Intrusion Detection System (APIDS): • An application Protocol-based Intrusion Detection System (APIDS) is a system or agent that generally resides within a group of servers.
- 22. 22 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Application Protocol-Based Intrusion Detection System (APIDS): • It identifies the intrusions by monitoring and interpreting the communication on application- specific protocols.
- 23. 23 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Hybrid Intrusion Detection System: • Hybrid intrusion detection system is made by the combination of two or more approaches to the intrusion detection system.
- 24. 24 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Hybrid Intrusion Detection System: • In the hybrid intrusion detection system, the host agent or system data is combined with network information to develop a complete view of the network system.
- 25. 25 Intrusion Detection System (Cont..) Classification of Intrusion Detection System(IDS) Hybrid Intrusion Detection System: • The hybrid intrusion detection system is more effective in comparison to the other intrusion detection system. Prelude is an example of Hybrid IDS.
- 26. 26 Questions Any Question Please? You can contact me at: [email protected] Your Query will be answered within one working day.
- 27. 27 Further Readings • Chapter No. 1 Computer_Security_Principles_and_Practice_(3rd_E dition) By William Stallings and Lawrie Brown
- 28. 28 Thanks