 |
An IDS is a proactive intrusion detection tool.
It used to detect and classify intrusions and attacks of the security policies automatically at network-level and host-level infrastructure in a periodic manner.
IDS is classified into network-based intrusion detection system (NIDS) and host-based intrusion detection system (HIDS)
Network behaviors are collected using network equipment via mirroring by networking devices:
Switches, routers, and network taps and analyzed in order to identify attacks and possible threats concealed within in network traffic
Characteristics of log files on the user computer in order to detect attacks is called HIDS
|
IEEE/ICACT20210214 Slide.04
[Big Slide]
[YouTube]