Intrusion Detection System

Intrusion Detection System

Abstract
An intruder is somebody ("hacker" or "cracker") attempting to break into or misuse your system. The word "misuse" is broad, and can reflect something severe as stealing confidential data to something minor such as misusing your email System for Spam.
An "Intrusion Detection System (IDS)" is a system for detecting
such intrusions. Network intrusion detection systems (NIDS) monitors’ packets on
the network wire and attempts to discover if a hacker/cracker is attempting to break into a system (or cause a denial of service attack). A typical example is a system that watches for large number of TCP connection requests (SYN) to many different ports on a target machine thus discovering if someone is attempting a TCP port scan. A NIDS may run either on the target machine who watches its own traffic (usually integrated with the stack and services themselves), or on an independent machine promiscuously watching all network traffic (hub, router, probe). Note that a "network" IDS monitors many machines, whereas the others monitor only a single machine system integrity verifiers (SIV) monitors system files to find when a intruder changes them (thereby leaving behind a backdoor). The most famous of such systems is "Tripwire". A SIV may watch other components as well, such as the Windows registry and chron configuration, in order to find well know signatures. log file monitors (LFM) monitor log files generated by network services. In a similar manner to NIDS, these systems look for patterns in the log files that suggest an intruder is attacking.
A typical example would be a parser for HTTP server log files that looking for intruders who try well-known security holes, such as the "phf" attack.
Example: swatch deception systems, which contain pseudo-services whose goal is to emulate well-known holes in order to entrap hackers.