What are the types of intrusion detection system?

Table of Contents

An intrusion detection system (IDS) is a device or software application that monitors a network for malicious activity or policy violations. Any malicious activity or violation is typically reported or collected centrally using a security information and event management system. Some IDS’s are capable of responding to detected intrusion upon discovery. These are classified as intrusion prevention systems (IPS).

IDS Detection Types

There is a wide array of IDS, ranging from antivirus software to tiered monitoring systems that follow the traffic of an entire network. The most common classifications are:

• Network intrusion detection systems (NIDS): A system that analyzes incoming network traffic.
• Host-based intrusion detection systems (HIDS): A system that monitors important operating system files.

There is also subset of IDS types. The most common variants are based on signature detection and anomaly detection.

• Signature-based: Signature-based IDS detects possible threats by looking for specific patterns, such as byte sequences in network traffic, or known malicious instruction sequences used by malware. This terminology originates from antivirus software, which refers to these detected patterns as signatures. Although signature-based IDS can easily detect known attacks, it is impossible to detect new attacks, for which no pattern is available.
• Anomaly-based: a newer technology designed to detect and adapt to unknown attacks, primarily due to the explosion of malware. This detection method uses machine learning to create a defined model of trustworthy activity, and then compare new behavior against this trust model. While this approach enables the detection of previously unknown attacks, it can suffer from false positives: previously unknown legitimate activity can accidentally be classified as malicious.

IDS Usage in Networks

When placed at a strategic point or points within a network to monitor traffic to and from all devices on the network, an IDS will perform an analysis of passing traffic, and match the traffic that is passed on the subnets to the library of known attacks. Once an attack is identified, or abnormal behavior is sensed, the alert can be sent to the administrator.

Evasion Techniques

Being aware of the techniques available to cyber criminals who are trying to breach a secure network can help IT departments understand how IDS systems can be tricked into not missing actionable threats:

• Fragmentation: Sending fragmented packets allow the attacker to stay under the radar, bypassing the detection system's ability to detect the attack signature.
• Avoiding defaults: A port utilized by a protocol does not always provide an indication to the protocol that’s being transported. If an attacker had reconfigured it to use a different port, the IDS may not be able to detect the presence of a trojan.
• Coordinated, low-bandwidth attacks: coordinating a scan among numerous attackers, or even allocating various ports or hosts to different attackers. This makes it difficult for the IDS to correlate the captured packets and deduce that a network scan is in progress.
• Address spoofing/proxying: attackers can obscure the source of the attack by using poorly secured or incorrectly configured proxy servers to bounce an attack. If the source is spoofed and bounced by a server, it makes it very difficult to detect.
• Pattern change evasion: IDS rely on pattern matching to detect attacks. By making slight adjust to the attack architecture, detection can be avoided.

Modern networked business environments require a high level of security to ensure safe and trusted communication of information between various organizations. An intrusion detection system acts as an adaptable safeguard technology for system security after traditional technologies fail. Cyber attacks will only become more sophisticated, so it is important that protection technologies adapt along with their threats.

Barracuda CloudGen Firewalls have elevated beyond the tradition intrusion detection systems generally used by today's less advanced firewalls. The Intrusion Detection and Prevention System (IDS/IPS) of the Barracuda CloudGen Firewall strongly enhances network security by providing complete and comprehensive real-time network protection against a broad range of network threats. In addition, all Barracuda CloudGen Firewall models can apply IPS/IDS to SSL encrypted web traffic using the standard 'trusted man-in-the-middle' approach.

Do you have more questions about Intrusion Detection Systems? Contact us today!

Call +61370367802

Chat Live

More proprietary and sensitive information have become available online than ever before. This has led to a corresponding increase in the number of cybercriminals trying to get hold of this valuable information. 

If a malicious attacker successfully penetrates your network, it can lead to several potential losses, including downtime, data breaches, and loss of customer trust. Luckily, using intrusion detection systems (IDS) types can help you safeguard your network and on-premise devices.

What Is an Intrusion Detection System (IDS)?

An intrusion detection system (IDS) is a hardware device or software app that monitors inbound and outbound network traffic to detect vulnerability exploits, policy violations, and malicious activity. 

The system places sensors or network devices like servers, firewalls, and routers to analyze traffic activity continuously and detect abnormal changes in patterns. In case it detects unusual behavior, the IDS will notify administrators immediately. The administrator can then review alarms and take action to eliminate threats right away.

In a nutshell, an IDS can:

• Monitor online user behavior
• Recognize attack patterns within network packets
• Detect abnormal traffic activity and raise notifications 
• Ensure user and system activity compliance with security policies

For example, you can use the IDS to analyze data carried by traffic networks to detect known malware or other malicious content. If the system does detect this type of threat, it’ll automatically notify your security team, who can then investigate and remediate to prevent the attack from taking over the system.

Alternatively, you can also set up the system to report such threats to a security information and event management (SIEM) system.

How an Intrusion Detection System Works

An intrusion detection system allows you to catch malicious agents before they can do any real damage to your network by detecting anomalies promptly and effectively. 

It monitors online traffic to and from all devices on the network and quietly operates behind a firewall as a secondary filter for malicious network packets. An IDS usually looks for two suspicious cybercrime clues:

• Signatures or patterns of known attacks
• Abnormal deviations from regular activity

The system relies on pattern correlation to identify security threats, which allows the system to compare network packets to a database with signatures of known cyberattacks. Here are some of the most common cyber attacks an IDS can flag using pattern correlation:

• Scanning attacks that send packages to the network to collect information about open or closed ports, active hosts, permitted traffic types, and software versions
• Malware like trojans, ransomware, worms, viruses, and bots
• Buffer overflow attacks that replace database content with malicious executable files
• Asymmetric routing that sends malicious packets and bypasses security controls with different entry and exit routes
• Traffic flooding breaches that cause network overload (example: DDoS attacks)
• Protocol-specific attacks targeting to target, as the name suggests, specific protocols like TCP, ARP, ICMP, and so on

Once an IDS identifies any of the above anomalies, it flags and alerts the issue to your security team, which can either be a simple note in an audit log or an urgent message to the administrator. The responsibility then shifts to your team, who should troubleshoot the problem and identify (and eliminate) the root cause of the issue as quickly as possible.

The 3 Intrusion Detection Systems (IDS) Types (+ 2 Intrusion Detection Methods)

Let’s discuss the different ways you can classify an IDS. At the moment, there are three main types of intrusion detection software, depending on if you view these as a part of a single system: 

1. Network Intrusion Detection System (NIDS) 
2. Network Node Intrusion Detection System (NNIDS) 
3. Host Intrusion Detection System (HIDS) 

Let’s understand how each type of intrusion detection system works in more detail below.

1. Network Intrusion Detection System (NIDS)

A Network Intrusion Detection System (NIDS) is placed or deployed as strategic touchpoints across your network with the aim to cover these areas where traffic is most likely to be vulnerable to cyberattacks.

Typically, the system is applied to entire subnets and attempts to match passing traffic to a database of known attacks. It passively monitors all network traffic coming to the points on the network on which it’s deployed, plus you can make a NIDS more secure and harder to detect for intruders. As the intruder won’t realize their potential attack has already been detected by the NIDS, you’ll get more time to take remedial measures to protect your network.

There are a few shortcomings, too.

As a NIDS software tool monitors and analyzes a large amount of traffic, it can sometimes have low specificity. This means the system can miss an attack or fail to detect anomalies happening in encrypted traffic. Other times, the NIDS may need more manual involvement from you or your administrator to ensure they are configured correctly.

2. Network Node Intrusion Detection System (NNIDS) 

A Network Node Intrusion Detection System (NNIDS) is similar to the NIDS—but with one major difference: it’s applied to one host at a time instead of the entire subnet.

The system checks each node connected to your network for threats and malicious activity. Think of it as the security guard that checks the bags of each person outside of the mall.

3. Host Intrusion Detection System (HIDS)

A Host Intrusion Detection System (HIDS) is installed on independent network devices, meaning it runs on all the devices in the network with access to the internet and other parts of the enterprise network. 

It monitors the whole system’s file set and compares it to its previous “snapshots.“ The idea here is to identify significant differences outside normal business use and to notify the administrator in case of any missing or significantly altered settings or files. The HIDS primarily uses host-based actions, including file access across the systems, application use and files, and kernel logs.

Admittedly, the HIDS has a few advantages over the NIDS. This is because the former can look more closely at internal traffic and work as a second-line defense against malicious packets the latter failed to detect.

Besides the above three intrusion detection systems types, there are two main approaches to detecting intrusion: signature-based IDS and anomaly-based IDS.

• Signature-based IDS: A common approach used by most IDS to detect intrusion, this IDS focuses on looking for a signature, patterns, or a known identity of a general or specific intrusion event. 

That said, a signature-based IDS is only as good as how up-to-date its database is at a given moment, which is why you need systems to regularly update the database with current signatures or identities to ensure it can detect intruders promptly.

Another problem with signature-based IDS is that malicious agents can get around it by frequently changing small things about how they attack your system, which will make it difficult for the database to identify it. This also means the IDS will miss out on a completely new attack type—or any other attack that doesn’t exist in the database. 

Databases also become more comprehensive with time, which will correspondingly increase the processing load to analyze each connection and check it against the database.

• Anomaly-based IDS: Completely different from signature-based IDS, an anomaly-based IDS looks for all the kinds of unknown cyberattacks that are typically harder for a signature-based IDS to detect. 

It uses machine learning approaches to compare models of reliable behavior with abnormal or new user behavior, so anything that’s strange or unusual to the system gets instantly flagged. At the same time, the system isn’t perfect, meaning previously unknown, but legitimate behavior can also get flagged accidentally. 

Anomaly-based IDS also assumes network behavior is always predictable and that distinguishing good traffic from bad is simple. But considering the system looks at the behavior of traffic and not the payload, it can have problems figuring out which traffic to flag if a network is running on a non-standard configuration. 

That said, anomaly-based IDS is still a good option for determining when someone is sweeping or probing a network before launching a cyberattack. It can pick up signals in the network from the sweeps and probes, and instantly notify the administration to take the necessary precautions.

How to Get Started With an Intrusion Detection System

Below, we’ll help you figure out how to use an IDS to protect your system from malicious agents. Let’s take a quick look.

Determine Baseline and Pay Attention to Deployment

Establishing a baseline can ensure your IDS detects abnormal behavior on your network. Each network carries a different type of traffic, so when you have a clear initial baseline, you can greatly minimize—even prevent—false positives and false negatives. 

Besides the baseline, you also want to deploy the IDS at the highest point of visibility to overwhelm the system with data. 

While choosing the right IDS and deployment location will depend on the network and your security goals, placing the IDS at the edge of a network, behind the firewall, is an ideal place. If you’re having trouble dealing with intra-host traffic, consider installing multiple IDSes across the network.

Set Up Stealth Mode

You can set your IDS to run instant mode, making it hard to detect malicious agents. To do so, make sure the IDS has two network interfaces: one for the network and another for generating alerts. In addition, the IDS should use the monitored interface as input only.

Test the IDS while you’re at it. This will ensure it’s capable of detecting potential threats and responding to them properly. You can have security professionals do a penetration test or use test datasets. Regardless of your choice, be sure to run these tests regularly so that everything continues to work as expected.

Tune the IDS is to the Network and Regularly Update the Threat Database

There’s no harm in changing the default settings of the IDS where it makes sense for your network. The configuration should accommodate all your devices, applications, protocols, security points, ports, and other parts of the network. Once you’re done customizing configuration to apply to your network infrastructure, you’ll have a solid base ready for prompt detection.

Next, instruct your team to continually update the threat database. As mentioned, having an obsolete database will render the entire system ineffective, defeating the whole purpose of implementing an IDS in the first place. A good tip is to have all your IDSes and databases follow the principle of zero-trust security.

Investigate and Respond to Incidents Promptly

Training IT staff and having an incident response plan are prerequisites for effective cyber threat management. 

Your incident response plan must include skilled security personnel who know how to respond quickly and effectively without disrupting daily operations, plus define proper controls and established protocols to ensure your organization complies with applicable industry requirements (GDPR, HIPAA, SOC 2). If needed, add a secondary analysis platform to analyze threats after an IDS raises an alarm.