Host-based intrusion detection system: Difference between revisions

Revision as of 01:01, 23 February 2016

Revision as of 05:18, 17 July 2016

Line 10:

=== Monitoring dynamic behavior ===

Many computer users have encountered tools that monitor dynamic system behaviour in the form of [[anti-virus software|anti-virus]] (AV) packages. While AV programs often also monitor system state, they do spend a lot of their time looking at who is doing what inside a computer -– and whether a given program should or should not have access to particular system resources. The lines become very blurred here, as many of the tools overlap in functionality.

Intrusion prevention systems are a type of HIDS software that protects against [[buffer overflow]] attacks on system memory and can enforce [[security policy]].<ref name=cox_gerg2004/>

Line 24:

==== Technique ====

In general a HIDS uses a [[database]] (object-database) of system objects it should monitor -– usually (but not necessarily) file system objects. A HIDS could also check that appropriate regions of memory have not been modified -– for example, the system call table for [[Linux]], and various [[virtual method table|vtable]] structures in [[Microsoft Windows]].

During the communication establishment phase and while transferring the data requested by the client, the host's server and the client exchanges a passphrase to verify their identity. The server uses the same passphrase all the time for this purpose. Based upon that an object is created.

Line 33:

==== Operation ====

At installation time -– and whenever any of the monitored objects change legitimately -– a HIDS must initialize its checksum-database by scanning the relevant objects. Persons in charge of computer security need to control this process tightly in order to prevent intruders making un-authorized changes to the database(s). Such initialization thus generally takes a long time and involves [[cryptography|cryptographically]] locking each monitored object and the checksum databases or worse. Because of this, manufacturers of HIDS usually construct the object-database in such a way that makes frequent updates to the checksum database unnecessary.

Computer systems generally have many dynamic (frequently changing) objects which intruders want to modify -– and which a HIDS thus should monitor -– but their dynamic nature makes them unsuitable for the checksum technique. To overcome this problem, HIDS employ various other detection techniques: monitoring changing file-attributes, log-files that decreased in size since last checked, and numerous other means to detect unusual events.

Once a system administrator has constructed a suitable object-database -– ideally with help and advice from the HIDS installation tools -– and initialized the checksum-database, the HIDS has all it requires to scan the monitored objects regularly and to report on anything that may appear to have gone wrong. Reports can take the form of logs, e-mails or similar.

=== Protecting the HIDS ===

A HIDS will usually go to great lengths to prevent the object-database, checksum-database and its reports from any form of tampering. After all, if intruders succeed in modifying any of the objects the HIDS monitors, nothing can stop such intruders from modifying the HIDS itself -– unless security administrators take appropriate precautions. Many [[Computer worm|worms]] and [[Computer virus|viruses]] will try to disable anti-virus tools, for example.

Apart from crypto-techniques, HIDS might allow administrators to store the databases on a [[CD-ROM]] or on other read-only memory devices (another factor militating for infrequent updates...) or storing them in some off-system memory. Similarly, a HIDS will often send its logs off-system immediately -– typically using VPN channels to some central management system.

One could argue that the [[trusted platform module]] comprises a type of HIDS. Although its scope differs in many ways from that of a HIDS, fundamentally it provides a means to identify whether anything/anyone has tampered with a portion of a computer. Architecturally this provides the ultimate (at least {{As of|2005|alt=at this point in time}}) host-based intrusion detection, as depends on hardware external to the [[central processing unit|CPU]] itself, thus making it that much harder for an intruder to corrupt its object and checksum databases.

Line 50:

==See also==

* [[IBM Internet Security Systems]] – commercial HIDS / NIDS

* [[Intrusion detection system]] (IDS)

* [[Network intrusion detection system]] (NIDS)

* [[VerisysOSSEC]] – a multi-platform open commercialsource HIDS

* [[Tripwire (software)]] -– commercial HIDS

* [[OSSEC]] - a multi-platform open source HIDS

* [http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/ Deep Security] - a commercial multi-platform HIDS

* [[Trusted Computing Group]]

* [[Trusted platform module]]

* [[IBM Internet Security SystemsVerisys]] -– commercial HIDS / NIDS

* [https://www.threatstack.com ThreatStack]

==References==

Line 76 ⟶ 74:

==External links==

* [http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/ Deep Security] -– a commercial multi-platform HIDS

* [https://www.threatstack.com ThreatStack]

{{Use dmy dates|date=July 2011}}