Most organization with security infrastructure has become necessary to implement intrusion detection systems because of increased in number and severity due to signs of security problems. There are two types of intrusion detection system either NIDS or a HIDS approach are depend on how to select for their specific system and network environments. Combining these two technologies will produce truly effect results when work together will greatly improve network resistance to attacks and misuse.

The graphic below demonstrates how host-based and network-based intrusion detection techniques work together because some events are detectable by network IDS only. Others that is detectable only at the host IDS.

Strengths of Host-based Intrusion Detection Systems that the network-based systems cannot match

Close to-real-time detection and reaction

Intrusion detection is the route of monitoring the events taking place in a network or computer system. Both intrusion detection systems have different type of timing that is monitored. Many early host-based IDSs used timing scheme, as because it relied on operating system audit trails to generate as files that producing verification results of whether an attack was doing well or not. But in many cases an attack can be detected by intruder and stopped it before damage is done.

Host-based IDS monitor explicit system activities

Application-based IDSs are subset of host-based IDSs since host-based IDSs operate on information such as operating system audit logs which are collected from individual computer system. Host-based detection can analyze activities with great reliability and precision, for examples, host-based IDS can monitor all user login and logoff activity. Furthermore, determining which processes are involved in an operating system. Disparate network-based IDSs, host-based IDSs can “distinguish” the conclusion of an attempted attack as quickly as it is executed. Ultimately, host-based system is able to examine changes to key system files and executables frequently targeted by attacks. Attack such as install Trojan horses can be stopped. Network-based system sometimes misses this type of activity. Host-based detection systems are talented to associate users and programs with their effects on a system to alert the information such as what users issued what command and when. This is mainly because HIDS are part of the target and are therefore capable to provide very superior information concerning the state of the system throughout an attack.

Host-based IDS can detect attacks that network-based system fail to spot

Host-based system is able to detect attacks via computer equipment such as keyboard that connected to critical server but do not cross the network, but network-based IDS cannot detect such attacks. In other words, HIDS only have to deal with attacks directed at the target itself and do not worry about capturing all the packets that cross a network. Consequently, NIDS are greatly less computationally expensive and have comparatively low performance impact on the host platform.

Strengths of network-based Intrusion Detection Systems that the host-based systems cannot match

Network-based IDS can detect attacks that host-based system fail to spot

HIDSs cannot detest sign of suspicious activity such as attacks can only be indentified when travel across a network, for examples; IP-based denial-of-service (DOS) and fragmented packet (TearDrop) attacks because such attacks only can be recognized when travel across the network. NIDS may be invisible to the attacker while a HIDS will almost certainly leave some software “footprint” on systems where it is installed. NIDS deal with traffic as theoretical data for examples; a denial of service or “death packet” which might collapse a target host will not influence the NIDS.

Instantaneous detection and reaction

Network-based will gather information from network traffic streams to produce “real-time” IDS results quickly to allow the IDS to take immediate action to detect attack. Network-based IDS captured information sources from LAN segment or network backbones by analyzing network packets that are linked to the network segment, in so doing, with the network component providing early warning to immediate termination of the attack.

Network-based Intrusion detection system are installed per network segment rather than per host

Installing host-based IDSs on each host in the organization can be tremendously time-consuming and more expensive to deploy, since IDS has to be and installing software on every system that is to be monitored. For examples, coverage of 100 systems might require to installing a HIDS on each of the 100 systems. Whereby, network-based IDS allow strategic deployment at essential technique for viewing network traffic destined to several systems. Consequently, network-based systems do not require software to be installed and managed on a variety of hosts. In other words, NIDS are operating environment independent and may be invisible to the attacker.

When deploying network-based IDSs to locate the system sensors to obtain advantages. A network-based placed external of a firewall can detect attacks from the external humankind, that break through the network’s perimeter defences, yet still the firewall may be rejecting these attempts. Host-based systems unable to see rejected attacks that hit a host inside the firewall will not produce information that important in assess security policies.

Conclusion

In summary, NIDS do extremely well at detecting network-level abnormalities and abuses but NIDS may miss packets due to congestion on the network link that they are monitoring. Secondary, NIDS do not have a good notion of user identity because TCP/IP traffic does not convey an association. Therefore the NIDS would have difficulty telling the administrator accurately whether or not the attack had any effect.

In a nutshell, the HIDS are more hostile about file integrity checking and collecting information including their CPU usage and file accesses. But the strengths of the HIDS relate directly to its weaknesses simply because HIDS is part of the target, any information it provides may be altered or deleted. for that reason, HIDS will have difficulty detecting attacks that completely wipe out the target system. When the operating system is crashed, the HIDS has crashed along with it and not alert is generated.

Last but not least, a mixture of IDS tools must be used. Both HIDS and NIDS have matching strengths and weaknesses which, when combined, yield a very robust detection capability.

Advantages and disadvantages of deploying IDS

Overview

Network Manager should request a proper guidance from vendors who specialize in IDS deployment and capable to provide detailed documentation and advice to select right features and capabilities Intrusion detection software where new flaws and vulnerabilities are discovering on a daily basis. There are many way of describing Intrusion detection systems. The primary descriptors are the system monitoring approaches, the analysis strategy, and the timing of information sources and analysis. The most common commercial Intrusion detection systems are real-time network-based. In order to select the best Intrusion detection systems and to integrate intrusion detection functions with the rest of the organization security infrastructure, governing factors. The most important that to prevent crisis behaviour that can abuse the system by increasing the perceived risk of discovery, improved diagnosis and rectification of causative factors.

The first steps needed to illustration the characteristic of the threat from outside and inside an organisation, assisting in making decisions regarding the network is likely to be attacked and allocation of computer security resources. Additionally, understanding the frequency and features of attacks allows Network Manager drawing up the budget for network security resources whether the network currently under attack or likely to be attack.

In today’s hacking environment an attack can be launched and completed in under a millisecond. So that, another consideration that Network Manager should understand the functional components of the IDS whether components are the Host on which the IDS software runs. Most of the well-known desktop operating systems such as Windows 95-98 and Windows ME lack system logging facilities.

Accountability and response are two overarching goals that Network Manager should state for intrusion detection systems. It is extremely difficult to enforce accountability in any system with weak identification and authentication mechanisms. To achieve the goals, Network Manager should understand and evaluate the control strategy of the input and output of the IDS then analyze which process model for Intrusion detection can help to determine what goals are best addressed by each intrusions detection system. For instance, military or other organizations that deal with national security issues tend to manage with a high degree of regulation. Some Intrusion Detection systems offer features that support enforcement of formal use policies.

The resources prerequisite for each category of IDS varies broadly. Solution or general method to categorize Intrusion Detection systems is to assembly by information source. Network-based intrusion detection system analyze network packet. Other Intrusion Detection systems analyze information generated by the operating system.

Perhaps the Network Manager can specify a security goal is by categorizing an organization’s threat concerns. At this time, Network Manager can review the existing organization security policies, network infrastructure and resource level. If, on the other hand, the organization wishes to actively respond to such violations so that they can deal with alarms in an appropriate manner.

The following session will discussed the advantages and disadvantages associated with different type of deployment of Intrusion Detection systems in an organization.

Advantages and disadvantages of deploying Network Intrusion Detection systems

The above diagram shows a typical deployment of Network Intrusion detection systems for doing packet analysis. An intrusion detection system placed outside the firewall to detect attack attempts coming from Internet. The advantages of Network-based IDS can be ready to protect against attack and even made undetectable to many attackers. To accomplish advantages of Network Intrusion detection system, well-placed network-based IDS can monitor a large network but it may have complicatedness processing all packets in a large or busy network and, consequently, may fail to distinguish an attack launched during periods of high traffic. Other disadvantages of Network-based Intrusion detection system cannot analyze encrypted information. Location 1 of Network-based IDS sensors, placed behind the external firewall and Router has advantages to observe attacks, originating from the outside world, that break through the network’s perimeter defences that may target the ftp server or web server.

Most network-based Intrusion detection system cannot tell whether or not an attack was successful. Location 2 of the Network-based IDS sensors placed outside an external firewall has advantages to document sort of attack originating on the Internet that target to attack the network. For full enterprise coverage Network Intrusion detection system must be placed on each network segment and should be able to remotely manage the various Network Intrusion detection systems, collate the information gathered, and display the enterprise-wide information on a console. Now the market has a number of products that detect attacks in real-time and react straight away, hopefully before damage is done. An effective method for real-time Intrusion Detection is to monitor security-related activity occurring on the various systems and devices that make up the network. Real-tome activity monitors can detect attacks such as attempts to access unauthorized sensitive files or to replace the log-in program with a new version. When suspicious activity is detected the real-time activity monitor can take immediate action before damage is done. The advantage of real-time activity monitors is that they deploy close to the mission-critical data and applications. Monitoring for attacks from both the inside and the outside the network becomes much easier, since all of the devices are being watched.

Advantages and disadvantages of deploying Host-based Intrusion Detection Systems

A host-based Intrusion Detection System resides on the system being monitored and tracks changes made to important files and directories with ability to monitor events local to a host. One of the advantages of host-based IDS is that it does not have to look for patterns, only changes within a specify set of rules. Host-based intrusion detection methodologies fall under Post-event audit trail analysis. For instance, products in this category perform automated audit trail analysis, reduction and management. Persistently the purchase of such a product can be justified on the cost savings achieved through the centralized and automation of audit trail management. Other advantages are that investigators can go back in time and do historical analysis of events that have occurred in the past. Lastly, this is particular helpful in exploration of break-ins that have taken place over a period of time.

From the network-based security viewpoint, by the time it detects the security problem, ‘it’s normally too late to react and look after the data, and the resulting consequences of the attack go far deeper into the network without resistance. In due course, the damage is already done by the time you find out. Also, given that most hackers learn how to cover up their tracks by tampering with audit trails, after-the-fact analysis often misses attacks.

Conclusion

In tradition way, most industrial devices lean to be primarily signature based like virus detection systems so they need periodic updates of these signatures to detect the most recent threats. An additional feature, called Active Response, that many NID systems offer is the ability to automatically react to detected alerts to protect the network from the threat.

The majority attacks at the present come from the Internet, and the threat from the Internet is ever-increasing every year. Further, as large and medium businesses implement more sophisticated Internet defenses, it may have the effect of focusing attention on smaller businesses as hackers look for targets with a higher probabilities of success. Clearly, as small businesses use the Internet more and the threat from Internet attack increases, the risk increases. To help them mitigate this risk, they will find much of the attention of influential people and organizations in the IT industry is focused on deploying IDS systems.

As present, it would be difficult to read about the Information Technology (IT) or IT security without encountering a wide array of advice in print and online recommending or assuming your organization has deployed a NIDS. It is easy and perhaps necessary to be influenced by these sources because they are a valuable source of information and analysis. Mainly because IT person don’t have the time to research every new idea for running their networks, and they usually don’t have a test tab. So they depend on published information to help guide policy and make decisions.

In the case of NIDS, the advice is universally in favour of deployment. The sensor located in location 1 and 2 are the eyes of a network as defined above diagram, NIDS systems capture and analyze traffic across some network boundary. These will log data on every signal back to the monitoring station. With the sensors placed at these points, it becomes possible to observe analyze and document traffic travelling into and out of the network. With sensors in these positions a number analyses become possible whereby data from the outside sensor can be analyzed to provide information on the type, frequency, source and the target of reconnaissance scans and attacks. This information can then be used to identify specific scans, attacks, targets, and to an extent specific sources of malicious signals coming at the internal network. Secondly, the NIDS will show breaches of the firewall. The classic sign of this is a questionable signal showing up both in the outside and inside sensors. When this happens, and there is not established session from within the LAN, it’s time to have a look at the firewall rules to see why this is happening. It is the only way an analyst can identify attacks and scans that don’t match a predefined signature. By analyzing the logs of traffic, usually on the outside interface, it is possible to identify patterns showing new scans and attacks that are not captured by the NIDS signature library. In can provide records of network traffic for forensic analysis. All of these above analyses are different parts of the same idea. As the “eye” of the network, it makes observation and recording of network traffic possible. If analysis resources are added, it makes it possible to answer many questions about the signal environment outside the firewall, the effectiveness of the firewall, and the kinds and volume of traffic flowing through the network.