1. INTRUSION DETECTION SYSTEMS
Manuel Martinez
ISSC342 D001

2. OUTLINE History Network-Based Intrusion Detection Systems
Host-Based Intrusion Detection Systems
Distributed Intrusion Detection Systems

3. HISTORY OF IDS

4. Network-Based Intrusion Detection Systems

5. Network-Based Intrusion Detection Systems
It monitors a network segment or several hosts through one network.
Listens all traffic in the network segment.
NIDS can see the “big picture” concerning network-based attacks;
It does not work well in switched and ATM networks.
If the IDS cannot monitor all traffic it will be overloaded and eventually crash.

6. Host-Based Intrusion Detection Systems

7. Host-Based Intrusion Detection Systems
HIDS NIC does not work on promiscuous mode; it only listens to the traffic destined for the NIC's specific.
HIDS can analyze data after it has been decrypted.
HIDS disadvantages is that only monitors only one system.
It requires more man power to administer each system.

8. Distributed Intrusion Detection Systems

9. Distributed Intrusion Detection Systems
DIDS can be:
Signature-based. This method uses known patters to identify attacks.
Anomaly-based. What is not considered normal is regarded as malicious.
DIDS can be composed of various sensors: HIDS, NIDS or a combination of both.