1. INTRUSION DETECTION SYSTEMS Tristan Walters Rayce West

2. OVERVIEW  Definition – What is intrusion detection and intrusion detection systems(IDS)  Characteristics of Intrusion Detection Systems  Typical Components of Intrusion Detection Systems  Types of Intrusion Detection Systems  Network-Based  Host-Based  Wireless  Conclusion

3. DEFINITION  Intrusion Detection  The process of monitoring and analyzing a computer system or network for suspicious behavior or potential threats  Intrusion Detection Systems  The software and/or hardware that automate the process of monitoring events on a system or network and analyzing gathered information for intrusions

4. CHARACTERISTICS  Information recording  Logging gathered information  Analyzing information  Notifying system administrators  Reports

5. TYPICAL COMPONENTS  Sensors  Collect data from various sources.  Network packets, log files, etc  Management Servers  Analyze information collected by sensors  Can decide if an intrusion is occurring and take action  User Interface  Typically a software tool for system admins  Allows admin interaction with the IDS  Databases  Store sensor gathered data, logging information, etc

6. NETWORK-BASED IDS  Monitors computer networks for possible intruders  Analyzes network traffic and transport/application protocols  Primary component  Sensors -  Inline – sensors placed in direct network traffic flow  Passive – sensors connected to the network from the outside  Logging  Focuses on network information  IP addresses/MAC addresses, transportation protocols, etc

7. INLINE SENSOR

8. PASSIVE SENSOR

9. HOST-BASED IDS  Monitors events on a single host machine for attacks  Code analysis – malicious code, buffer overflows  Running applications  Changes in the host network settings  File system monitoring – access and integrity  Primary component  Agents – Software installed on the host that monitors and communicates with the management server  Logging  Focuses on application information, file paths and names, user information

10. HIDS ARCHITECTURE

11. WIRELESS IDS  Very similar to NIDS. Monitors wireless networks rather than physical  Analyzes wireless network protocols for suspicious activity  Primary Component  Sensors – samples frequency channels for malicious activities  Channel Scanning – constantly scans different channels in different frequency bands  Fixed sensors – a sensor placed in a fixed location  Mobile sensors – sensors that allow movement around a network  Logging  Channel numbers, sensor ID that observed a malicious event, source MAC address

12. WIRELESS IDS SETUP

13. CONCLUSION  There are a variety of different IDSs that contain a variety of components  IDSs are essential in any organization and institute that handle important data  Very helpful for system administrators