Cyber Security Intrusion Detection and Prevention
IDS systems watch network or host activity and raise alerts on suspicious behavior, while IPS systems sit inline and actively block that traffic before it does harm.
Two Related but Different Tools
An Intrusion Detection System (IDS) is a passive observer. It usually watches a copy of network traffic (fed through a network tap or a switch's mirror/SPAN port) or reads logs on a host, compares what it sees against rules or a behavior baseline, and raises an alert when something looks malicious. It does not sit in the direct path of the traffic, so it cannot stop the packet that triggered the alert — only report it.
An Intrusion Prevention System (IPS) does the same detection work but sits inline, directly in the path traffic must pass through. When it identifies something matching a malicious pattern, it can drop the packet, reset the connection, or block the source outright before the traffic ever reaches its target.
Detection Methods
- Signature-based detection — matches traffic or files against a database of known attack patterns, similar to antivirus signatures.
- Anomaly-based detection — builds a baseline of what 'normal' traffic looks like for a network or host, then flags meaningful deviations from it.
- Stateful protocol analysis — understands the expected sequence of a protocol (like TCP's handshake) and flags traffic that violates it.
Signature-based detection is precise and generates few false alarms for attacks it already knows about, but it is blind to genuinely new attack techniques that have no matching signature yet. Anomaly-based detection can catch novel or zero-day behavior because it isn't looking for a specific known pattern, but it tends to produce more false positives, since unusual-but-legitimate activity can also deviate from the baseline.
Where These Systems Live
- NIDS/NIPS (network-based) — monitors traffic flowing across a network segment, watching many hosts at once.
- HIDS/HIPS (host-based) — runs as an agent on a single machine, watching its logs, file integrity, and running processes.
Example: A Simple Signature-Style Rule
# Illustrative detection rule, written in a Snort-like syntax
# Alerts on repeated SSH connection attempts from the same source,
# a common sign of a brute-force login attempt.
alert tcp any any -> $HOME_NET 22 (
msg:"Possible SSH brute-force attempt";
flags:S;
threshold: type threshold, track by_src, count 5, seconds 60;
sid:1000001;
)Fitting IDS/IPS into a Layered Defense
A firewall decides whether traffic is allowed based mostly on addresses, ports, and simple rules — it generally doesn't inspect the content or behavior of allowed traffic in depth. IDS/IPS fill that gap by inspecting the content and patterns of traffic that a firewall would otherwise let straight through. Combined with a VPN protecting data in transit and endpoint protection on individual devices, IDS/IPS form one layer in a defense-in-depth strategy, where no single control is expected to catch everything on its own.
Exercise: Cyber Security Network Security
What is the primary function of a firewall?
