INTRUSION DETECTION SYSTEM

1. IDS

1.1. Detect computer attacks and/or misuse

1.2. Three types

1.2.1. Signature base

1.2.1.1. Similar to virus scanning

1.2.1.2. only as good as the signature database

1.2.1.3. Good for scripted exploits

1.2.2. Anomaly base

1.2.2.1. exceeding a limit on login attempts

1.2.2.2. Finding a NIC card in promiscuous mode

1.2.2.3. User sending abnormally large numbers of email

1.2.3. Decoy base

1.2.3.1. Honeypots

1.3. ALOT of output

1.3.1. Tendency not to keep up

1.3.2. Outsource

1.3.2.1. expensive

1.4. Dorothy Denning

2. Snort

2.1. Network based

2.2. lightweight IDS performs real time traffic analysis and packet logging on IP networks