Intrusion Detection & Prevention

Content Leader: Jess Garcia - Last Updated: February 5, 2007

Index

• Network-based Intrusion Detection & Prevention
• Host-based Intrusion Detection & Prevention
• Log Analysis

Intrusion Detection

What is Intrusion Detection?

Definition by Dirk Lehmann (Siemens CERT), taken from the SANS IDS FAQ:

• ID stands for Intrusion Detection, which is the art of detecting inappropriate, incorrect, or anomalous activity. ID systems that operate on a host to detect malicious activity on that host are called host-based ID systems, and ID systems that operate on network data flows are called network-based ID systems.
  
  Sometimes, a distinction is made between misuse and intrusion detection. The term intrusion is used to describe attacks from the outside; whereas, misuse is used to describe an attack that originates from the internal network. However, most people don't draw such distinctions.
  
  The most common approaches to ID are statistical anomaly detection and pattern-matching detection.

IDS / IPS Resources

• General Information

• SANS IDS FAQ

• Tools

• English version
• Spanish version

• Articles, Papers & Presentations

• For a list of IDS/IPS papers and presentations, check Honeypots.net

• Books

• See a list of IDS/IPS Books here.

• Online Publications & Newsletters

• Coming soon...

• Mailing Lists

• Focus on IDS @ Securityfocus: General discussion about IDS technologies.
• Snort: In case you use "the pig" for your Intrusion Detection.
• loganalysis General discussion about log analysis.

• Webcasts

• Coming Soon...

• IDS/IPS Conferences

• DIMVA - Detection of Intrusions & Malware, and Vulnerability Assessment.
• RAID - Recent Advances in Intrusion Detection

• See the Essentials > Security Events sections to find out the exact dates of each conference.

• Training

• Check Honeypots.net for a list of IDS/IPS training options.
• We (shamelessly) recommend the SANS Institute Intrusion Detection In-Depth track. Check the Events section to see when this course will be taught in Europe.

• Websites

• Coming Soon...