Host-based ids, Computer Network Security

Assignment Help:

Host-Based IDS

A host-based IDS (HIDS) resides on a particular computer or server and monitors activity only on that system. HIDS also called as system integrity verifiers as they benchmark and monitor the status of key system files and detect when intruder creates, modifies, or deletes files. It is efficient enough to monitor system configuration databases. Most of the HIDSs work on principle of configuration or change in management. The HIDS examines the files and logs for predefined events. The advantage of HIDS over NIDS is which it can be installed usually so that it can access information encrypted when traveling over network.

Advantages and Disadvantages of HIDSs

Advantages

-Can detect local events on host systems and detect attacks that may elude a network based IDS
- Functions on host system, where encrypted traffic will have been decrypted and is available for processing.
-Not affected by use of switched network protocols
-Can detect inconsistencies in how applications and systems programs were used by examining records stored in the audit logs.

Disadvantages

-Pose more management issues
-Vulnerable both to direct attacks and attacks against host operating system
-Does not detect multi host scanning, nor scanning of non-host network devices
-Susceptible to some denial of service attacks
-Can use large amounts of disk space
-Can inflict a performance overhead on its host systems


Related Discussions:- Host-based ids

Cyclic redundancy check (crc), CYCLIC REDUNDANCY CHECK (CRC) To activa...

CYCLIC REDUNDANCY CHECK (CRC) To activate a network system to check move error without increasing the amount of information in every packet another most successful method is m

Base lining-information security, Base lining •    Organizations do not ...

Base lining •    Organizations do not have any contact to each other •    No two organizations are identical to each other •    The best practices are a moving target •    K

Hardware, Hardware, Software, and Network Asset Identification What info...

Hardware, Software, and Network Asset Identification What information attributes to track is dependent on: •    Requires of organization/risk management efforts •    Management

Collision detection, COLLISION DETECTION The signals from two devices ...

COLLISION DETECTION The signals from two devices will interfere with each other and the overlapping of frames is known a collision. It does not cause to the hardware but data

Cyber security, How to pretect my computer from attacking

How to pretect my computer from attacking

Describe the five-layer network using block diagrams, Problem 1: a) One...

Problem 1: a) One of the limitations of file processing systems is data inconsistency. Briefly explain with the help of an example what do you understand by this phrase. b)

Corresponding access control matrix, Consider a computer system with three ...

Consider a computer system with three users: Alice, Bob and Cindy. Alice owns the file alicerc, and Bob and Cindy can read it. Cindy can read and write the file bobrc, which Bob ow

Differentiate between private key and public key encryption, Problem (...

Problem (a) Differentiate between private key and public key encryption. (b) What issue with private key encryption is resolved with public key encryption? (c) Describe

Write Your Message!

Captcha
Free Assignment Quote

Assured A++ Grade

Get guaranteed satisfaction & time on delivery in every assignment order you paid with us! We ensure premium quality solution document along with free turntin report!

All rights reserved! Copyrights ©2019-2020 ExpertsMind IT Educational Pvt Ltd