Types of idss and detection methods, Computer Network Security

Assignment Help:

Types of IDSs and Detection Methods

IDSs operate as network based, host based, or application based systems and focused on protecting network information assets. All the IDSs use one of 2 detection methods signature based, statistical anomaly-based.

Signature-Based IDS/ knowledge –based IDS


Signature Based IDS examines data traffic in search of patterns that match known as signatures. It is extensively used because many attacks have very clear and distinct signatures. Problem with this approach is that as new attack strategies are identified, the IDS’s database of signatures should be updated continually.

Statistical Anomaly-Based IDS


The statistical anomaly based IDS or behavior based IDS sample network activity to compare to traffic that is normal. When measured activity is outside baseline parameters or clipping level, IDS will trigger an alert to the administrator. It can also detect new types of attacks. Requires more overhead and processing capacity than signature based. It may generate several false positives and thus is less commonly used than the signature based type.


Related Discussions:- Types of idss and detection methods

Virtual packets, VIRTUAL PACKETS These data packets serve same reason ...

VIRTUAL PACKETS These data packets serve same reason in Internet as frames on LAN. Every packet has a header. Routers, which are normally gateways, transfer packets between ph

Attackers motives behind the cyber attack, Attacker's Motives behind the Cy...

Attacker's Motives behind the Cyber Attack Before adapting the necessary measures to deal with the problem, understanding and evaluating the blogger's psyche and his motivation

Example of a public key algorithm, Question : (a) There are two approa...

Question : (a) There are two approaches for providing confidentiality for packets in a network using symmetric encryption: End-to-End Encryption and Link Encryption. State wh

Systems development life cycle security-information security, The Role of t...

The Role of the Investigation The first phase, investigation is the most significant. What problem is the system being developed to solve? During investigation phase, objectives

Define half-duplex, A  half-duplex (HDX) system gives communication in b...

A  half-duplex (HDX) system gives communication in both directions, but only one direction at a time. Hardly, once a party stats receiving a signal, it must need for the transmi

Explain the approaches to lric modeling, (a) Cost allocation mechanisms ar...

(a) Cost allocation mechanisms are important when it comes to establishing other aspects of inter-firm compensations and how these are transferred to the users. There are two pri

What is information security, What is information security Information s...

What is information security Information security protects information (and facilities and systems which store, use and transmit it) from a broad range of threats, in order to p

Man-in-the-middle attacker, - Alice, Bob and Charlie have a secret key a=3,...

- Alice, Bob and Charlie have a secret key a=3, b=4, c=5, in that order. - They would like to find a common secret key using Diffie-Hellan key exchange protocol (with g=2, p=5).

Define the term enterprise network, a) Define the term "Enterprise Network"...

a) Define the term "Enterprise Network". b) Briefly discuss the similarity and differences between a switch and a router. c) A company XYZ has been renting the 1 st Floor of

Fuckkkkk, Ask question #Minimum.. 100 words accepted#

Ask question #Minimum.. 100 words accepted#

Write Your Message!

Captcha
Free Assignment Quote

Assured A++ Grade

Get guaranteed satisfaction & time on delivery in every assignment order you paid with us! We ensure premium quality solution document along with free turntin report!

All rights reserved! Copyrights ©2019-2020 ExpertsMind IT Educational Pvt Ltd