INTRUSION DETECTION AND PREVENTION SYSTEMS INTRODUCTION

An IDS (Intrusion detection system) is software that automates the intruder detection process.

An IPS (Intrusion prevention system) is the software that has IDS capabilities and can also try to stop possible incidents.

IDPS (Intrusion detection and prevention systems) focuses on identifying possible incidents, logging information on them, trying to stop them and reporting them to security administrators. The information it records are important events observed and then produce the reports.

There are techniques to respond to the detection of an intruder, which may be the change of security measures (eg, firewall reconfiguration) or change the content of what they are attacking.

The IDPS technology will depend on the type of event they are monitoring and the way in which they unfold.

There are many types of IDPS technologies, which differ mainly by the type of events they are able to identify and the methodologies used to identify incidents. However, all types of IDPS technology typically perform the following functions:

Record information related to the observed events: the information is usually stored locally or can be sent to separate systems as logging servers.

Notify system administrators about important events observed: these notifications, commonly known as alerts, can be made through different methods such as emails or syslog messages.
Generate reports: summaries of monitored events.

Read More:  ids security