Your Guide to Intrusion Detection Systems

What is an IDS?

Ideally, the only people that can access your network systems are those you trust.  However, the reality is that there are rogue elements from all over the globe continually on the lookout for opportunities to gain access to your systems. To prevent an intrusion attack that could cause untold damage to your business requires that you have adequate security measures in place.

One such solution is an Intrusion Detection System (IDS), which actively detects and then alerts administrators to any activity deemed suspicious on your network. In this article, we are going to take an in-depth look at Intrusion Detection Systems: what they are, the different types, and the benefits and challenges associated with them.

What is an Intrusion Detection System (IDS)?

Intrusion Detection Systems are software applications or devices that monitor network traffic for anomalous or suspicious activity. If detected, an alert is sent to the network administrator or using a SIEM system collected centrally. A Security Information and Event Management System will combine outputs from several different sources, and using an alarm filtering method can differentiate malicious activity from false alarms. The information provided by the alert will usually contain details about the intrusion's source address, target address and suspected type of attack.

Typically, an Intrusion Detection System (IDS) is combined with other security measures to protect a company's network. With firewalls, antivirus, and antimalware software in place, IDS provides a second line of defence. An IDS only warns of any suspicious activity that is taking place but does not prevent it.

Types of Intrusion Detection System

Intrusion Detection Systems can be either host-based and installed on a single device or network-based, which, as the name implies, is located on a network.

Host Intrusion Detection Systems (HIDS)

Host-Based IDS analyses and monitors activity related to the system configuration and log files for devices connected to a network. Hosts require HID sensors installed on them, which can be just on a single device, but more typically it will be connected to all devices connected to the network. The sensors take a snapshot of the existing system files and will compare them with prior snapshots. They will look for disparities such as files being altered, deleted, or overwritten. If so, an alert will be sent to the administrator to investigate any unexpected activity.

Network Intrusion Detection Systems (NIDS)

Network intrusion systems are typically deployed at strategic points across the network infrastructure. They monitor the inbound and outbound network traffic in those areas more susceptible to an attack. The Network Intrusion Detection System will check for unusual behaviour or attacks by scanning the content and header information of all packets that move across the network. NIDS will require a sensor module to pick up traffic, and these sensors will be equipped with specific signatures that determine what constitutes an attack. However, it can also be customised to add additional signatures based on the network's requirements or directly import those provided by the NIDS user community. The sensors will then compare the signatures with the traffic captured to identify any traffic that could be harmful.

Network-Based or Host-Based Intruder Detection?

Ideally, it shouldn't be an either-or situation as both of these intrusion detection systems have their strengths and weaknesses and can benefit from being run in tandem. NIDS operates in real-time, so any issues are flagged as they occur. In contrast, HIDS is better for dealing with insider threats and internal network attacks.

Intrusion Detection Methods

Both host and network-based intrusion detection systems use the same two modes of operation signature-based or anomaly-based. The majority use both, but some will only use just one mode of operation.

Signature-Based IDS

A signature is a specific pattern that corresponds to a known threat. Signature-based IDS will compare pre-configured attack signature patterns in network traffic to determine if they constitute a threat. A Network-based Intrusion Detection System will investigate the checksums in captured packets while a Host IDS will inspect log and configuration files for abnormal behaviour.

However, while signature-based detection is low on false positives and useful in the detection of known threats, it is ineffectual against new threat types that don't have a signature pattern. It is also essential to keep up with regular updates for this method of detection to be successful.

Anomaly-Based IDS

While signature-based is best for identifying existing threats, anomaly-based IDS is better at detecting threats that are new or unknown with no pre-existing signature. Anomaly-based detection is focused on identifying unusual or abnormal patterns of activity that might not have been flagged by signature-based IDS. It is particularly useful for checking if there is an imminent attack on a network by detecting if someone is probing or sweeping it.

The anomaly method of IDS can be implemented on both HIDS and NIDS. With hosted intrusion detection systems, for example, the anomaly could be unusual port activity on a device indicating port scanning or multiple repeated unsuccessful login attempts.

As for NIDS, machine learning is used to model an existing baseline of trustworthy behaviour that can be compared with new or unusual behaviour. The only problem with this is that unknown, but rightful behaviour can be flagged as false positives that can cause issues.

Signature vs Anomaly Based Intrusion Detection 

A comprehensive intrusion detection system for network security should combine the two. While either has their pros and cons, by combining them, you benefit from their consolidated strengths. While anomaly-based methods are more proactive and will detect new and unknown threats, signature-based detection is faster and easier to set up and doesn't experience issues with false positives.

IDS vs IPS

As we have previously discussed, an IDS is a monitoring system that analyses and detects unusual traffic and sends an alert, the administrator then decides on a course of action with the information given. IPS meanwhile stands for Intrusion Prevention System. It works similarly but is more proactive in that it reacts to any suspicious activity and takes action on it.

Just the same as an IDS, IPS uses signature and anomaly detection methods and can be host or network-based. However, rather than just detecting threats, it responds to them too, hence 'prevention system.'

An Intrusion Detection System is not automated and requires manual human intervention to block potential attacks. It is better used as a forensic tool to investigate security issues after an incident has already taken place. An Intrusion Prevention System, in contrast, automatically detects and blocks any threat, thus offering a more comprehensive system. For instance, if an IPS identifies an attack, it can reset a connection, drop data packets and block the IP address of the malicious attempt.

Often you will find the two combined under the umbrella of IDPS – Intrusion Detection and Prevention Systems. You'll also find that next-generation firewalls combine traditional firewalls, with IPS and IDS.

It will depend on your needs which is the better solution for you – IDS or IPS. Generally, the consensus is that an Intrusion Prevention System with its real-time automated capabilities is the most comprehensive solution of the two for network security.

Benefits of IDS

An Intrusion detection system has many benefits as part of a comprehensive security strategy. They include:

• IDS can detect threats that firewalls or antivirus software could miss.
• It will automatically notify an administrator of any irregular activity.
• IDS offers privacy protection for users, only recording activity when any action is taken. It also doesn't view or store content.
• IDS provides dynamic threat response and can be customised to detect specific threats, allowing an enterprise to identify threats aimed at their particular business.
• IDS helps to meet regulatory compliance (for example ISO 27001 and GDPR) as it provides greater visibility across a network. IDS logs can also be used if documentation is required. In the same manner, this data can also serve as evidence against a person who has exploited your systems.
• IDS can help a business recognise the number, type and sophistication of attacks that are targeted against them and adjust security measures to meet the threat. It can also analyse and detect network device configuration issues.
• When a virus enters your system, an IDS can inform you which devices are compromised, and you can track its propagation to find out which other devices were infected. This is very useful for slowing or stopping the progress of the attack before eliminating it.

Disadvantages and Challenges of IDS

IDS does, of course, have some drawbacks:

• IDS is not a comprehensive, all-inclusive security solution. An IDS will only detect attacks, not prevent or block them. Other security measures need to be put in place to thwart cyber-threats.
• The signature database must be continually updated with the latest threats. With the increasing amount of threats, it pays to have the signature library kept fresh and up to date. If neglected, it could make your systems susceptible to attacks that administrators aren't alerted to.
• One of the primary issues with IDS is false positive alerts. Often false positives outnumber any actual threats, though an IT administrator can fine-tune the IDS to reduce their frequency. The big issue is with complacency – if false positives are ignored, it's very easy for a real threat to go undetected.
• On a similar note, the administrator tasked with tuning the IDS configuration must be able to set it up, so it is tailored to provide adequate protection and reduce the number of potential false positives. Finding the right systems analyst who is knowledgeable enough to perform the task might prove difficult.
• The majority of intrusion detection systems can't process encrypted packets, allowing intrusions on the network. It can leave systems at risk until the IDS discovers the intrusion when it is deeper in the network, and more critical intrusions have taken place.

In Conclusion

An intrusion detection system can offer a certain degree of security for a business, but for more comprehensive protection, a firewall, IDS and IPS are required. Intrusion Detection and Prevention Systems can be part of an effective solution as long as their signature databases are kept updated. In the case of IPS, the administrator must configure it to match the enterprise’s requirements, and monitor it diligently. Businesses are increasingly turning to managed IDS/IPS/IDPS services. By outsourcing the monitoring and maintenance of the IDS service to trusted experts, businesses benefit from a 24/7 service at a fraction of the cost.