Page 472 - StudyBook.pdf

456 Chapter 7 • Topologies and IDS

It’s also important to understand that an IDS can operate in one of four states.
These include:

■ Positive An attack occurred and the IDS detected it

■ Negative No attack occurred and none was detected
■ False Positive No attack occurred yet the IDS believes one did and trig-
gered an alert
■ False Negative An attack occurred yet was not detected

As you can imagine, these states are not all the same.The goal of the security
professional tuning the IDS is to configure it in such a way so that attacks are
detected and false alarms do not occur. In reality, this is not always so easy as it can
take a lot of time and effort to get an IDS properly set up. If configured incorrectly,
there may be too many false positives so that users become desensitized and begin
to ignore the alarms.There is even a worse condition in that the IDS may be mis-
configured so that false negatives occur. In this condition, an attack that has hap-
pened may never be detected.
IDSes may also be distinguished by their differing approaches to event analysis.
Some IDSes primarily use a technique called signature detection.This resembles the
way many antivirus programs use virus signatures to recognize and block infected
files, programs, or active Web content from entering a computer system, except that
it uses a database of traffic or activity patterns related to known attacks, called attack
signatures. Indeed, signature detection is the most widely used approach in commer-
cial IDS technology today.Another approach is called anomaly detection, which uses
rules or predefined concepts about “normal” and “abnormal” system activity (called
heuristics) to distinguish anomalies from normal system behavior and to monitor,
report on, or block anomalies as they occur. Some IDSes support limited types of
anomaly detection; most experts believe this kind of capability will become part of
how more IDSes operate in the future. Read on for more information about these
two kinds of event analysis techniques:

■ Signature-based IDS characteristics

■ Pros A signature-based IDS examines ongoing traffic, activity, transac-
tions, or behavior for matches with known patterns of events specific
to known attacks.As with antivirus software, a signature-based IDS
requires access to a current database of attack signatures and some way
to actively compare and match current behavior against a large collec-

www.syngress.com