Protocol-based intrusion detection system: Difference between revisions

Revision as of 20:08, 7 May 2007

Latest revision as of 12:38, 12 July 2024

(16 intermediate revisions by 15 users not shown)

Line 1:

{{WikifyMore sources needed|date=DecemberJuly 20062024}}

A '''protocol-based intrusion detection system''' ('''PIDS''') is an [[intrusion detection system]] which is typically installed on a [[web server]], and is used in the monitoring and analysis of the [[Communications protocol|protocol]] in use by the computing system. A PIDS will monitor the dynamic behavior and state of the protocol and will typically consist of a system or agent that would typically sit at the front end of a server, monitoring and analyzing the communication between a connected device and the system it is protecting.

A typical use for a PIDS would be at the front end of a web server monitoring the [[HTTP]] (or [[HTTPS]]) stream.<ref>{{Cite web |date=2023-04-19 |title=What is an Intrusion Detection System (IDS)? {{!}} IBM |url=https://www.ibm.com/topics/intrusion-detection-system |access-date=2024-07-09 |website=www.ibm.com |language=en-us}}</ref> Because it understands the HTTP relative to the web server/system it is trying to protect it can offer greater protection than less in-depth techniques such as filtering by [[IP address]] or [[port number]] alone, however this greater protection comes at the cost of increased computing on the web server.

A '''protocol-based intrusion detection system (PIDS)''' is an [[intrusion detection system]] that focuses its monitoring and analysis on the protocol or protocols in use by the computing system.

Where HTTPS is in use then this system would need to reside in the "shim" or interface between where HTTPS is [[Cryptography|un-encrypted]] and immediately prior to it entering the Web [[presentation layer]].

== Overview ==

A PIDS will monitor the dynamic behavior and state of the protocol and will typically consist of a system or agent

that would typically sit at the front end of a server, monitoring and analysing the communication protocol between a connected device (a user/PC or system) and the system it is protecting.

=== Monitoring dynamic behavior ===

A typical place for a PIDS would be at the front end of a web server monitoring the HTTP (or HTTPS) protocol stream and would understand the HTTP protocol relative to the web server/system it is trying to protect.

AsAt a basic level a PIDS would look for, and enforce, the correct (legal) use of the protocol.

At a more advanced level the PIDS can learn or be taught acceptable constrictsconstructs of the protocol, and thus better detect anomalous behaviourbehavior.

Where HTTPS is in use then this system would need to reside in the "shim" or interface between where HTTPS is un-encrypted and immediately prior to it entering the Web presentation layer.

=== Monitoring dynamic behavior ===

As a basic level PIDS would look for, and enforce the correct (legal) use of the protocol.

At a more advanced level the PIDS can learn or be taught acceptable constricts of the protocol, and thus better detect anomalous behaviour.

==See also==

* [[Application protocol-based intrusion detection system]] (APIDS)

* [[Host-based intrusion detection system]] (HIDS)

* [[Intrusion detection system]] (IDS)

* [[Network intrusion detection system]] (NIDS)

* [[Tripwire (software)]] -– a pioneering HIDS

* [[Host-based intrusion detection system]] (HIDS)

* [[Application protocol-based intrusion detection system]] (APIDS)

* [[Tripwire (software)]] - a pioneering HIDS

* [[Trusted Computing Group]]

* [[Trusted platform module]]

==References==

[[Category:Security software]]

{{Reflist}}

[[Category:System administration]]

{{DEFAULTSORT:Protocol-Based Intrusion Detection System}}

[[Category:Intrusion detection systems]]

[[Category:SecurityWeb server management software]]

[[es:PIDS]]