Intrusion Detection and Prevention Systems

von Carmen F.

Intrusion Detection

Sensing and analyzing system events for the purpose of noticing (i.e., becoming aware of) attempts to access system resources in an unauthorized manner. […]

This includes the following subtypes:

"Active detection": Real-time or near-real-time analysis of system event data to detect current intrusions, which result in an immediate protective response.

"Passive detection": Off-line analysis of audit data to detect past intrusions, which are reported to the system security officer for corrective action.”

Intrusion Detection and Prevention System (IDPS)

„A process or subsystem, implemented in software or hardware, that automates the tasks of (a) monitoring events that occur in a computer network and (b) analyzing them for signs of security problems.” (RFC4949)

Als IDPS werden Systeme bezeichnet, die sowohl erkennen als auch aktiv in den Datenstrom eingreifen können.

Dies sind entweder Appliances welche „inline“, also im tatsächlichen Datenfluss positioniert sind und „realtime“ auf Angriffe reagieren (network-based) oder

Auf Host-Systemen installierte Software, die den Traffic zum/vom Host sowie andere relevante Aktivitäten überwacht (host-based)

Ablauf eines IDS