[Day 10] 2. IDS (Intrusion Detection System)

Intrusion

An intrusion is an unauthorized attempt to access, manipulate, or disable a computer system or network. IDS helps to monitor and detect such activities.

---

Types of IDS

Based on Behavior

1. Passive IDS:

   • Monitors network traffic and logs data.

   • Example: Snort (logs traffic without taking direct actions).

2. Active IDS (IPS - Intrusion Prevention System):

   • Detects intrusions and prevents unauthorized access.

   • Takes actions such as stopping the traffic or alerting administrators.

Based on Installation

1. Host-based IDS (HIDS):

   • Monitors activities on a specific host (e.g., file changes, system logs).

2. Network-based IDS (NIDS):

   • Monitors network traffic for suspicious activities.

3. Hybrid IDS:

   • Combines features of HIDS and NIDS.

---

Analysis Scheme

1. Preprocessing:

   • Breaks packets into smaller pieces for easier processing.

2. Analysis:

   • Inspects packets based on predefined rules.

3. Response:

   • Takes appropriate actions based on the analysis (e.g., logging, alerting).

4. Refinement:

   • Adjusts IDS configurations to improve its effectiveness.

---

Intrusion Detection Methodologies

1. Signature-based Detection:

   • Uses predefined rules or signatures to detect intrusions.

   • Example:

     Copy

     local.rules

     in Snort.

2. Misuse Detection:

   • Identifies known attack patterns.

   • Example:

     Copy

     fail2ban

     monitors for repeated login failures.

3. Machine Learning-Based Detection:

   • Utilizes machine learning models to identify anomalies or new attack patterns.

---

IDS Architecture

1. Single-tiered Architecture:

   • Single-layer IDS setup.

   • Example: Snort Lab.

2. Multi-tiered Architecture:

   • Contains three components:

     • Sensors: Collect data.

     • Analyzer: Processes data.

     • Manager: Centralized control and alerting.

   • Centralized communication ensures all systems are informed.

3. Peer-to-peer Architecture:

   • Decentralized architecture where components communicate directly with each other.

---

IDS Evasion Techniques (Bypassing an IDS)

1. Payload Obfuscation:

   • Encodes payload to make it difficult for IDS to interpret.

2. Fragmentation:

   • Splits payload into smaller packets to bypass detection.

3. Denial of Service (DoS):

   • Overloads the IDS with excessive traffic to make it ineffective.

---

Intrusion Prevention System (IPS) Types

1. Host-based IPS (HIPS):

   • Protects individual hosts by monitoring and controlling activities.

2. Wireless IPS (WIPS):

   • Monitors and prevents attacks on wireless networks.

3. Network-based IPS (NIPS):

   • Monitors network traffic to prevent intrusions.

---