Introduction to Intrusion Detection and Prevention
Information security plays a key role in the successful operation of any organization; it ensures the confidentiality, integrity, and availability of information. Intrusion detection systems (IDS) and intrusion prevention systems (IPS) play a critical role in the defense-in-depth strategy used in the information security field. Historically, the role of intrusion detection was primarily that of monitoring in order to detect malicious or suspicious activity. Over time, the prevention capability was added in addition to detection, thereby creating IPS. As the nature of computation evolved over time, the nature of threat and attack vectors also evolved. Subsequently, the complexity of analysis and computation required by intrusion detection has also evolved in order to address the threat landscape. This chapter will introduce you to IDS and IPS at a high level. The chapter will cover the following topics:
- The need for information security
- Defense-in-depth strategy
- The role of network IDS and IPS
- Types of intrusion detection
- The state of the art in IDS/IPS
- IDS/IPS metrics
- Evasions and attacks
