WHAT IS INTRUSION DETECTION SYSTEM & TYPES OF IDS |

Intrusion detection system which works for a computer system and network to make them secure by attacks of many of many types of viruses which may destroy them. To secure information systems and to maintain them in that condition only is a very difficult task. The operational constraints are a system to secure the system but, it also sometimes fails to do that job. So, the work of Intrusion detection system(IDS) is to detect the insecure states of systems by monitoring them. The IDS system is used to detect the misuse done by the user of the information system; they also check the abuse done for the privileges.

In 1981, many Intrusion detection prototypes have been created by Denning. From all prototypes, only 59 of them have been listed by soberly. An information system is free of security flaws that are why the Intrusion detection system emerges in the computer security area. It is very difficult and costly to make your computer system not to be susceptible to attacks because there may be any mistake done in manufacturing or at the time of origin of the computer system.

An intrusion detection system (IDS) monitors network traffic and monitors for suspicious activity and alerts the system or network administrator. In some cases the IDS may also respond to anomalous or malicious traffic by taking action such as blocking the user or source IP address from accessing the network.

IDS comes in a variety of  "flavors" and approach the goal of detecting suspicious traffic in different ways. There are two types of IDS

•  Network bases (NIDS)
• Host based (HIDS) 

NETWORK BASED (NIDS)

Network Intrusion detection system are placed at a strategic point or point within the network to monitor traffic to and from all devices on the network. Ideally you would scan all inbound and outbound traffic, however doing so might create a bottleneck that would impair the overall speed of the network. The image shows the working concept of NIDS, all the network traffic (for hosts A, B and C) passes through NIDS.

HOST BASED (HIDS)

Host Intrusion Detection system are run on individual hosts or devices on the network. A HIDS monitors the inbound and outbound packets from the devices only and will alert the user or administrator of suspicious activity is detected. Host based IDS works on either of following 2 concepts, they are,

• Signature based - A signature based IDS will monitor packets on the network and compare them against a database of signature or attributes from known malicious threats. This is similar to the way most antivirus software software detects malware. The issue is that there will be a lag between a new threat being discovered in the wild and the signature for detecting that threat being applies to your IDS. During that lag time your IDS would be unable to detect the new threat.
• Anomaly based - An IDS which a anomaly based will monitor network traffic and compare it against an established baseline. The baseline will identify what is "normal" for that network- what sort of bandwidth is generally used. what protocols are used. what ports and devices generally connect to each other- and alert the administrator or user when traffic is detected which is anomalous, or significantly different, than the baseline.

       TYPES OF IDS

• PASSIVE IDS - A passive IDS simply detects and alerts. When suspicious or malicious traffic is detected an alert is generated and sent to the administrator or user and it is up to them to take action to block the activity or respond in some way.                                                                                                                                                                                                                                           
  
  
  

• REACTIVE IDS - A reactive IDS will not only detect suspicious or malicious traffic and alert the administrator, but will take pre-defined proactive actions to respond to the threat. Typically this means blocking any further network traffic from the source IP address user.                                                                                                                                                                                   
  

• SNORT - One of the most well known and widely used intrusion detection systems is the open source, freely available snort. It is available for a number of platforms and operating systems including both Linux, Windows. Snort has a large and loyal following and there are many resources available on the Internet where you can acquire signature too implement to detect the latest threats. For other freeware intrusion detection applications you can visit free IDS software on Google.