Last Updated 06 Jul 2020

Host based Intrusion Prevention

Words 502 (2 pages)

Intrusion Detection Systems (IDSs) recognize the presence of malicious code within traffic that flows through the holes punched into the firewall, our first layer of defense. Though, the word "intrusion detection" is a bit of a misnomer.

Richard Kemmerer and Giovanni Vigna of the University Of California, Santa Barbara, elucidate in an article in the IEEE Security and Privacy magazine: "Intrusion detection systems do not detect intrusions at all--they only identify evidence of intrusion, either while in progress or after the fact." (Edwin E. Mier, David C. Mier, 2004)

Order custom essay Host based Intrusion Prevention with free plagiarism report


An IDS recognizes security threats by detecting scans, probes and attacks, however does not block these patterns; it only reports that they took place. Yet, IDS logged data is invaluable as proof for forensics and incident handling. IDSs as well detect internal attacks, which are not seen by the firewall, and they help in firewall audits.

IDSs can be divided into 2 main categories, footed on the IDS alarm triggering mechanism: anomaly detection-based IDS and misuse detection-based IDS.

Anomaly detection based IDSs report deviations from "normal" or expected behavior. Behavior other than "normal" is measured an attack and is flagged and recorded. Anomaly detection is as well referred to as profile-based detection. The profile describes a baseline for normal user tasks, and the quality of these user profiles directly has an effect on the detection capability of the IDS. Techniques for constructing user profiles comprise: (Nong Ye, 2003).

Rule-based approach--Normal user behavior is characterized by creating rules, however analyzing normal traffic is a complicated task. A related approach is protocol anomaly detection.

Neural networks--These systems are trained by presenting them with a large amount of data, together with rules regarding data relationships. They then find out if traffic is normal or not; abnormal traffic raises an alarm.

Statistical approach--Activity profiles describe the behavior of system or user traffic. Any deviation from normal triggers an alarm.

The advantage of anomaly detection is that it can identify previously unknown attacks and insider attacks, without the need for "signatures"-- that is., predefined attack profiles.

One more benefit of anomaly detection is that it's impossible for the attacker to know what activity causes an alarm, thus they cannot assume that any particular action will go undetected.

The disadvantage of anomaly detection is that it produces a large number of "false positives"-- that is., alerts that are produced by legitimate activity. In addition, besides being complicated as well as hard to understand, building and updating profiles as well need a lot of work.

The other most important approach, misuse-detection based IDS (also called signature-based IDS), triggers an alarm when a match is found to a "fingerprint"-a signature contained in a signature database. These "fingerprints" are footed on a set of rules that match typical patterns of exploits used by attackers. As there is a known database of exploits, there are few false positives.

The disadvantage is that misuse-detection IDSs can merely detect already-known attacks. Besides, the "fingerprints" database needs to be incessantly updated to keep up with new attacks. The majority IDS products in the market at present use misuse detection.

Host based Intrusion Prevention essay

This essay was written by a fellow student. You can use it as an example when writing your own essay or use it as a source, but you need cite it.

Get professional help and free up your time for more important courses

Starting from 3 hours delivery 450+ experts on 30 subjects
get essay help 124  experts online

Did you know that we have over 70,000 essays on 3,000 topics in our database?

Cite this page

Explore how the human body functions as one unit in harmony in order to life

Host based Intrusion Prevention. (2016, Jun 20). Retrieved from

We use cookies to give you the best experience possible. By continuing we’ll assume you’re on board with our cookie policy

Save time and let our verified experts help you.

Hire writer