IDS Explained: How Intrusion Detection Works

TL;DR

An Intrusion Detection System (IDS) watches your network for suspicious activity and alerts you if it finds something. It’s like a burglar alarm for your computer system, but instead of detecting people, it detects malicious software or hackers.

How an IDS Works: A Step-by-Step Guide

1. Traffic Capture: The first thing an IDS does is capture network traffic. This means it copies data as it flows in and out of your network.
   • Network Tap/SPAN Port: It usually does this using a special piece of hardware called a network tap, or by mirroring traffic on a switch port (using SPAN – Switched Port Analyzer).
   • Packet Sniffing: The IDS uses software to ‘sniff’ the packets – small units of data that make up your network communication.
2. Analysis Methods: Once it has the traffic, the IDS analyzes it using two main methods:
   • Signature-based Detection: This is like looking for known fingerprints. The IDS compares the captured traffic to a database of known malicious patterns (signatures). If it finds a match, it raises an alert.

     # Example signature (simplified)

     signature = "evil_code_pattern"

   • Anomaly-based Detection: This is like learning what ‘normal’ traffic looks like. The IDS builds a profile of typical network activity, and then flags anything that deviates significantly from this baseline.

     This requires some initial ‘learning’ period to establish the normal behaviour.

3. Alerting: When the IDS detects something suspicious, it generates an alert. This can take several forms:
   • Log Entries: Writing information to a log file for later review.

     2024-10-27 10:30:00 - Possible intrusion detected! Source IP: 192.168.1.100

   • Email Notifications: Sending an email to a security administrator.
   • Console Alerts: Displaying a message on the IDS console.
4. Types of IDSs: There are different ways to deploy an IDS:
   • Network-based IDS (NIDS): Monitors traffic across your entire network.
   • Host-based IDS (HIDS): Runs on individual computers and monitors activity specific to that machine.
5. False Positives & Negatives: It’s important to remember IDSs aren’t perfect:
   • False Positive: An alert for something that isn’t actually malicious.
   • False Negative: Failing to detect a real attack.
   • Regular tuning and updating of the IDS is crucial to minimise these errors.

Important Considerations

• IDS vs IPS: An Intrusion Prevention System (IPS) goes one step further than an IDS – it can automatically block malicious traffic, not just alert you.
• Regular Updates: Keep your signature database up-to-date to protect against the latest threats.
• Log Review: Regularly review your IDS logs to identify and investigate potential security incidents.