An Intrusion Detection System (IDS) is a device or software application that monitors a network or systems for malicious activities or policy violations and produces reports to a management station. IDS come in many varieties, but generally most have similar high-level components and functions.
There are two main categories of IDS – network-based intrusion detection system (NIDS) and host-based intrusion detection system (HIDS). A NIDS is usually deployed on its own device and monitors network traffic passing through it (e.g. using a hub, switch, or network tap) looking for signs of anomalous or malicious traffic that could indicate a network attack from outside the network perimeter. A HIDS runs on individual hosts or devices on the network and monitors the inbound and outbound traffic passing through the host’s network stack as well as system and application logs and activities to detect unusual behavior or policy violations that could indicate an intruder has already gained access to the host.
In terms of architecture, most IDS consist of three main components – sensors, analyzers, and databases. The sensor is usually a network card or software driver that passively monitors and captures inbound/outbound packet traffic or host/system activity data. It then passes this data to the second component – the analyzer. The analyzer is the main detection engine that uses a database of signatures, rules, and behavioral analysis models to compare what the sensor is reporting against to determine if anything anomalous or malicious is occurring. For NIDS, the signatures/rules may indicate patterns of network traffic that are known malicious communication protocols, attacks, or exploits. For HIDS, the signatures/rules may flag things like changes to system files or unauthorized application usage. If the analyzer detects any matches between the observed traffic/events and its database, it will generate an alert sent to the third component – the database.
The database or data repository records and stores all the logs, data, alerts, and generated reports from the IDS sensor and analyzer activity for long-term trending and forensic analysis. Most IDS interfaces provide a central management console where an administrator can review logs and reports, configure alerting and reporting rules, and generate graphs/charts to visualize network traffic and event trends over time to look for potential issues or threats. Some IDS also have the capability for automated blocking or prevention functions, like alerting a firewall to deny traffic from an attacking host. The database is also important for tuning and updating the signature/rule database over time as new threats emerge.
In terms of detection techniques, IDS use a combination of signature-based detection and anomaly-based detection:
- Signature-based detection works by matching specific patterns, signatures, or rules that are indicative of known attack types, exploits, or malicious traffic to actively searching for a predefined criteria associated with a known threat pattern. This provides high accuracy but can only detect known threats with signatures.
- Anomaly-based detection builds profiles of normal network behavior and user/system activities and flags significant deviations from these profiles as potential threats. This type of detection can find previously unknown threats but generates more false positives requiring analysis to validate. Machine learning and AI techniques are commonly used to build and refine the behavioral profiling models over time through unsupervised learning of network traffic and event patterns.
The key challenges for any IDS are avoiding false alarms while also minimizing missed threats. Balancing these requires tuning and constant refinement of detection rules and models to account for changes in normal system usage and emerging threats. IDS also have limited capabilities within encrypted network traffic inspection. NIDS and HIDS provide continuous monitoring capabilities to help detect threats and provide situational awareness of network and host activity levels that could indicate security risks or active compromise. When combined with other security controls like firewalls, they are a useful layered defense mechanism.
Andrew Stroud