IDS, what is it and why do we need it?

In a nutshell
An Intrusion Detection System or simply IDS is a system that is used to determine if malicious activities have taken place against a computer system. IDS can detect intrusions that have circumvented firewalls or attacks occurred internally behind firewalls.

An IDS performs its tasks by collecting, logging and analysing network data and audit logs to detect signs of attack and anomaly. When suspected attacks are detected, an IDS triggers an alert and activates the alarm procedure as configured, for example, notifies the administrator or reconfigures the router/firewall etc.

Types of IDS
There are three common categories of IDS products on the markets; host-based, network-based and stack-based IDS. IDS technology is a rapidly evolving area and IDS vendors are taking a ‘hybrid’ approach using a combination of techniques. The classification of IDS is therefore becoming blurred.

• A host-based IDS is a software installed on an individual host/workstation. The IDS monitors log files for suspicious activities, unauthorized changes to system files and configurations.
• A network-based IDS uses what are called sensors to collect network packets for inspection and detection. Sensors are typically deployed at critical points on network segments and work as agents sending data back to a monitoring station for attack analysis.
• A stack-based IDS is a more recent approach and implementations differ between vendors. Basically, they are integrated to the TCP/IP protocol stack so that they may intercept attack packets, before them reaching the hosts’ operating system and applications.

   

 IDS detection techniques
The two common IDS detection techniques are statistical anomaly detection and signature-based detection, also known as behaviour-based and knowledge-based respectively.

Statistical anomaly detection is a simple idea; records a user’s computer usage behaviour to use as a reference model and triggers an alarm when the same user shows a very different usage pattern. The advantage is that it can detect previously unknown attack methods. By defining what are normal behaviours, violations can be detected almost in real-time. However, this approach is characterized by a high false-positive rate and not suitable for users who do not exhibit a static usage pattern. Currently, this approach is less common than the following signature/knowledge-based systems.

Signature-based systems rely on a database of attack methods. By comparing collected data against known attack patterns and system vulnerabilities exploits, they can pick out suspected traffic much like how a signature-based anti-virus program detects a suspicious virus. They have a lower rate of false alarm than anomaly detection systems. However, the shortcomings are they tend to be very resource intensive and their effectiveness depends largely on the quality of the vendor’s attack-signature database and how frequent the database is updated.

IDS today
Although IDS is not a new idea, it is not yet a fully mature and researched technology. There are some limitations, including,

• Generating too much false-positive alerts. An administrator may dismiss a real attack as another false alarm, in effect, negating the function of an IDS;
  
• IDS output a large amount of audit data that must be analyzed and examined by human operators in detecting intrusions and misuses, and
• Network-based IDS is unreliable on high-speed and switched networks, and most products have weaknesses.

Do we want IDS?
Surveys show that most companies understand the need to safeguard their business-critical data and IT infrastructure to stay competitive and even to survive. Many companies have installed firewalls but paid little or no attention to attacks detection and incident response.

An IDS is not a security panacea but it is a good early warning system much like the radar systems used during wartime. It can detect attacks in near real-time; alert an administrator as attacks are happening; expose a hacker’s technique and gather forensic evidence for legal requirements; reveal unknown system vulnerabilities; possibly track down hackers and stop an intrusion before it causing more damages. It is a tall order indeed.

An IDS is a detective and not preventative mechanism. It is best seen as an additional defence tool and not a replacement for a perimeter firewall and security audits. A truly effective IDS depends on correct configuration and finely-tuned rules and settings specific to the computer platform to be protected.

An IDS certainly plays a role in the corporate security defence arsenal. Any organization that is serious about IT security should install an IDS as part of the overall security strategy. Be warned that IDS is not a ‘install and forget’ system.