Please enable JavaScript.

Coggle requires JavaScript to display documents.

Intrusion Detection (:<3:classification ((2)Network-based IDS (sensor…

- - - - Host agent module
        
        LAN Monitor agent module
        
        Central Manager Module
    - - :part_alternation_mark:anomaly detection
        
        :cyclone:approaches
        
        :cyclone:threshold detection
        
        Drawbacks
        
        high false positive rate and negative
        
        :cyclone:profile based
        
        example metrics
        
        counter
        
        guage
        
        interval timer
        
        resource utilization
        
        analysis methods
        
        mean and standard deviation
        
        multivariate
        
        markov process
        
        time series
        
        Drawbacks
        
        high false positive rate
      - :part_alternation_mark:signature detection
        
        :sunflower:approaches
        
        :sunflower:rule-based penetration identification
        
        :sunflower:rule-based anomaly detection
        
        Drawbacks
        
        can't detect new attacks
  - - - :person_with_ball::skin-tone-3:Management server(s) with console (GUI)
      - :person_with_ball::skin-tone-3:A number of sensors to monitor packet traffic
    - - between external firewall and the web
      - protect one major backbone
      - Inside external firwall
      - protect specific workstation or LAN
    - - :part_alternation_mark:anomaly detection
        
        at application (mostly), transport, and network layers
        
        Attack patterns are detected in packets
      - :part_alternation_mark:signature detection
        
        attacks that cause abnormal behaviors are detected
        
        Ex:
        
        denial of service attacks
        
        scanning attacks