أنظمة الكشف والحماية من التطفل

Study Notes

IDS/IPS are security mechanisms designed to protect computer systems and networks from unauthorized access, attacks, or malicious activities.
Intrusion Detection Systems (IDS) monitor and analyze network or system activities to identify malicious behavior or security policy violations.
Intrusion Prevention Systems (IPS) not only detect but also take active measures to prevent intrusions or malicious activities.

Network-based IDS (NIDS): Monitors network traffic in real-time to identify suspicious patterns or signatures indicative of malicious activity.
Host-based IDS (HIDS): Monitors activities on individual computers or devices.

Packet Filtering: Analyzing packets in real-time and blocking those matching known attack signatures or patterns.
Stateful Inspection: Examining the context of network packets to determine legitimacy.
Behavioral Analysis: Monitoring for abnormal behavior and taking action if deviations are detected.
Throttling/Blocking: Limiting or blocking network traffic from specific sources or destinations.

DPI is a computer network packet filtering method that examines packet data to identify malicious activity.
It's an advanced method for examining and managing network traffic.

Logs are comprehensive files capturing activity on devices or software applications.
Log aggregation consolidates log data from across an IT environment, streamlining analysis.
Log analysis reviews computer-generated event logs to proactively identify bugs, security threats, or risks.

Correlation: Aggregating logs from different sources to understand events not visible in a single log.
Pattern Recognition: Modern machine learning technologies to identify patterns in log data.
Structured Format: All log data stored in a central location for human and machine interpretation.
Tagging and Classification: Tagging log data with keywords and classifying by type for quicker information retrieval.
Cross log comparison and analysis: Log files compared from different sources to identify correlations and threats.

Misuse-based (signature-based) detection: Detects known attack patterns.
Anomaly-based detection: Identifies abnormal, unusual behavior compared to "normal" patterns.
Specification-based detection: Checks if instructions violate security policies

Multiple IDS devices working together to improve situational awareness, analysis, and incident response.

Incident identification, response team coordination, and communication protocols are key components of an effective intrusion response plan.
Malware, Distributed Denial-of-Service (DDoS) attacks and phishing are common intrusion types.
Strategies for containment include isolating affected systems, blocking malicious activity, and monitoring the network.