Overview
Cyber intrusion:
It a malicious process to compromise a computer system by breaking the security or causing it to enter into an insecure state. This can be done in more menacing and pervasive ways like ransomware .It may include malicious threats like Malware or ransomware.
The act of cyber intrusion typically leaves traces that can be discovered by Intrusion Detection Systems. It generally sits directly behind the firewall and acts a complementary layer of analysis to detect dangerous content.
Step by step actions by IPS:
- Triggering an alarm for the administrator.
- Dropping the malicious packets.
- Blocks the traffic from the source address.
- Restoring the connection
The IPS works efficiently to avoid network performance degradation, at a fast pace because exploits can happen in near real-time.
Intrusion Detection System (IDS):
It is a system that monitors network traffic for suspicious activity and when discovered triggers alerts .It is basically a software application to scan a network for policy breaching activity. Vulnerable threats usually come as malicious inputs to a target application or service that attackers can use to gain control of an application or machine.
Cyber intrusion prevention system:
A cyber intrusion prevention system is a form of network security to detect and prevent identified threats. It monitors the network 24/7, looking for threats and capturing information about them.
Working principles:
Here the technologies have access to the deployed packets. It has a larger view for the entire network. It can either deployed inside the network or being offline as a passive sensor, in turn it receives packets from a network TAP or SPAN port.
It detects by the signature or by the anomaly. It compares the packet flows with the signature to match for any anomalies.
Working principle of Intrusion Prevention Systems:
It works by scanning all network traffic. Different threats that is prevented by an IPS
- Denial of Service (DoS) attack
- Distributed Denial of Service (DDoS) attack
- Various types of exploits
- Worms
- Viruses
This system deeply inspects every packet that travels across the network, for malicious packets and when detected are being detected, for the process it follows the following actions:
- When one threat is being detected it terminate the exploited TCP session and block the suspected IP address, while stops it from accessing any application, target hosts or other network resources unethically.
- Right after the firewall has been reconfiguring to prevent a similar attack occurring in the future.
Removing any leftover malicious contents that remain on the network following an attack. This thing is done by repackaging payloads; removing header information and removing any infected attachments from file or email servers.
Prevention techniques:
- Signature based approached :
This uses predefined signatures of threats. When a happened attack is being matched to one of those signatures, the system initiates necessary action.
- Anomaly based approached:
It monitors the abnormal or unexpected behaviors on the network. In case it detects any, the system blocks access to the target host immediately.
- Policy-Based:
In this approach the administrator configure security policies according to organizational security policies and the network infrastructure.
Different types of Intrusion Detection and Prevention System:
1. SolarWinds Security Event Manager (SEM):
It is a paid IDPS ideal for enterprise environments. .It can run on Windows , but also supports Windows, MacOS, and *nix log files. It collects and analyzes network and host data, and also integrates with Snort for network analysis. It has almost 700 built-in rules for event correlation with a user-friendly interface.
2. OSSEC:
An open-source host-based security is a host-based IDPS, and available free of cost.
It allows the Windows registry monitoring with MacOS privilege escalation detection.
It monitors the log file to detect threats.
3. Snort:
It is the most well-known and popular IDPS available. It is an open-source and free of cost. It is operable on all operating systems. It has large library of pre-built detection rules as it has deep visibility into network traffic.
4. Suricata:
It is compatible with Snort file formats with some additional features that Snort, such as such as performing network traffic analysis at the application level .It is available free of cost. It is an open source. It collects data at application layer. It can be integrated with a number of third-party tools. It is supported by Lua scripting support; with a user friendly interface .It has a parallel processing unit along with GPU support.
5. Zeek:
It is an extremely powerful NIDS. It has built-in scripting support that enables customization and customized automated responses to identified threats. It is an open source that runs on MacOS and *nix systems. It has integrated traffic logging, with customized automation.
6. Sagan:
It an open-source with IPSes, designed to provide both host-based and network-based intrusion detection and prevention. It is primarily host-based but can also be integrate with Snort and firewalls to protect network level. It is open source and compatible with Snort data .It can be integrated with multiple third-party tools. It runs on MacOS ,*nix systems and with firewalls for IP blocking.
7. Security Onion:
It is an open source Linux distribution combined with a number of IDPS and other security tools within a custom Linux distribution, such as Snort, Suricata, Zeek, and other popular open-source security tools.
8. McAfee Network Security Platform (NSP):
It is a closed-source NIDS .It is costly .It Protects against bots, Distributed Denial of Service (DDoS), ransomware, and many other attacks and blocks harmful sites
9. Palo Alto Networks:
It offers IPS for large enterprises as it comes with a commercial solution. It updates the threat protection profiles continuously and blocks harmful sites.
10. Fail2Ban:
Fail2Ban is an open-source host-based IPS .It is designed to detect and prevent the malicious actions. It working principle is based upon monitoring the log files. The “filters” Have been combined with automated remediation actions to form a “jail”.
It Runs on *nix and MacOS systems. It blocks malicious IP addresses automatically
