Types of idss and detection methods, Computer Network Security

Assignment Help:

Types of IDSs and Detection Methods

IDSs operate as network based, host based, or application based systems and focused on protecting network information assets. All the IDSs use one of 2 detection methods signature based, statistical anomaly-based.

Signature-Based IDS/ knowledge –based IDS


Signature Based IDS examines data traffic in search of patterns that match known as signatures. It is extensively used because many attacks have very clear and distinct signatures. Problem with this approach is that as new attack strategies are identified, the IDS’s database of signatures should be updated continually.

Statistical Anomaly-Based IDS


The statistical anomaly based IDS or behavior based IDS sample network activity to compare to traffic that is normal. When measured activity is outside baseline parameters or clipping level, IDS will trigger an alert to the administrator. It can also detect new types of attacks. Requires more overhead and processing capacity than signature based. It may generate several false positives and thus is less commonly used than the signature based type.


Related Discussions:- Types of idss and detection methods

Area subdivision, the advantages and disadvantages of area subdivision and ...

the advantages and disadvantages of area subdivision and where it is applicable

Calculate euler totient function value, (a) Explain the importance of the ...

(a) Explain the importance of the Euler Totient function in Cryptography. Calculate Euler Totient function value, φ(1280). (b) Explain the role of the Authentication Server (

Threat identification-risk management, Threat Identification After ident...

Threat Identification After identifying and performing a primary classification of an organization’s information assets, the analysis phase moves onto an examination of threats

Derive the transmitted crc header checksum, QUESTION (a) Consider the f...

QUESTION (a) Consider the following digital bit stream 01001100 is to be encoded in: i. NRZ-I ii. Pseudoternary iii. Manchester iv. Differential Manchester Show th

Minimum cost flow problem, QUESTION (a) A convex flow problem is a no...

QUESTION (a) A convex flow problem is a non linear network flow problem. Explain how a convex flow problem could be transformed into a Minimum Cost Flow problem. (b) Exp

Find the capacity of the wcdma, Question: (a) Describe the term interfe...

Question: (a) Describe the term interference in the space, time, frequency, and code domain. (b) Consider a 1 G - AMPS: 824-849 MHz (forward) ; 869-894 MHz (reverse). B

TCP/IP v OSI, What are the main differences between TCP/IP vs OSI?

What are the main differences between TCP/IP vs OSI?

Characteristics of radial basis function neural networks, Problem : (a)...

Problem : (a) Provide one possible classification of PCA, ART, RBF, and Fuzzy ARTMAP networks. (b) Describe in detail the characteristics of Radial Basis Function Neural Net

Security and basics steps in writing thesis, how can i start thesis? Please...

how can i start thesis? Please mention so of examples?

Write Your Message!

Captcha
Free Assignment Quote

Assured A++ Grade

Get guaranteed satisfaction & time on delivery in every assignment order you paid with us! We ensure premium quality solution document along with free turntin report!

All rights reserved! Copyrights ©2019-2020 ExpertsMind IT Educational Pvt Ltd