Intrusion Detection Systems
An Intrusion Detecton System (IDS) gathers and analyzes information from various areas within a computer or netowrk to identify possible violations of security policy, including unarthorized access as well as misuse.
Network Intrustion Detection Systems (NIDS) vs Host Based Intrusion Detection Systems (HIDS)
The monitoring approach of the system, or the point at which information is collected, is a primary factor in classifying different types of intrusion detection systems. A host-based intrusion detection system (HIDS) finds suspicious activity or known attack patterns on the specific host where it is installed. A network-based intrusion detection system (NIDS) collects information from the network traffic stream as it travels on the network segment.
In depth information on intrusion detection systems can be found on the National Institute for Standards and Technology link.
Host-based intrusion detection (HIDS)
- can detect backdoors into a network, such as unsecured modems or links from other organization units or business partners
- can detect insider attacks that don't traverse the network perimeter
- cost of entry is lower
- dedicated hardware not required
- Network-based intrusion detection (NIDS)
- high network bandwidth is a major challenge
- minimal performance impact on hosts and networks
- transparent to users
- can detect attacks based on malformed packets and denial-of-service attacks (not easily visible to host-based systems)
The best option is to combine both types of intrusion detection, as their strengths are complementary. NIDS can be placed on the network perimeters, and core servers be further protected with HIDS.
References:
SANS