Information networks can be highly susceptible to malicious attacks from worms, viruses and various other network threats, with regular new issues cropping up on these fronts. Such attacks can paralyze the networks, destroy important data and adversely affect productivity. To prevent this from happening, intrusion detection systems (IDS) are set up to protect information networks.
An intrusion detection system acts as a safeguard that detects attacks before or as they happen, alerts the system administration and then takes appropriate steps to disable the attacks, restoring the network to its normal working capacity. A certain degree of human supervision and investigation is usually required in intrusion detection systems, as the IDS is not completely foolproof. An intrusion detection system may, for instance, fail to identify some network threats or, in cases of busy networks, may not be able to check all the traffic that passes through the network.
In its day to day operation, the intrusion detection system monitors the user activity and traffic on the network, and keeps watch on the system configurations and the system files. If any abnormalities or attacks are detected, the intrusion detection system immediately sets up an alarm to bring the matter to the attention of the system administrator. The system may then proceed to deal with the network threats, or let the administrator decide on the best way to tackle the problem.
There are three main types of intrusion detection systems that together form an intrusion prevention system. The first is the network intrusion detection, which maintains a library of known network threats. The system checks around the Internet and constantly updates this library; this way the system is kept informed about the latest network threats and is able to better protect the network. The passing traffic is monitored and checked with the library, and if any known attack or any abnormal behavior matches with the ones in the library, the system gears up to block it.
The network node intrusion detection is the second part of the intrusion prevention system. It checks and analyzes the traffic that passes from the network to a specific host. The third part is the host intrusion detection system, which checks for any changes to the current system; if any files are modified or deleted, the host intrusion detection system sounds the alarm. It may either directly disable the attack or set up a new, improved security environment.