Host-based intrusion detection system: Difference between revisions

Revision as of 08:46, 11 October 2016

Revision as of 15:10, 6 March 2017

Line 1:

{{Refimprove|date=July 2011}}

A '''host-based intrusion detection system''' ('''HIDS''') is an [[intrusion detection system]] that monitors and analyzes the internals of a computing system as well as (in some cases) the network packets on its network interfaces (just like a [[Network intrusion detection system|network-based intrusion detection system]] (NIDS) would do).<ref name=newman2009/> This was the first type of intrusion detection software to have been designed, with the original target system being the [[mainframe computer]] where outside interaction was infrequent.<ref name=cn31_8_805/>

== Overview ==

{{Original research|section|date=July 2011}}

A host-based IDS monitors all or parts of the dynamic behavior and the state of a computer system. Besides such activities likeas dynamically inspectinspecting network packets targeted at this specific host (optional component with most software solutions commercially available), a HIDS might detect which program accesses what resources and discover that, for example, a word-processor has suddenly and inexplicably started modifying the system password database. Similarly a HIDS might look at the state of a system, its stored information, whether in [[Random Access Memory|RAM]], in the file system, log files or elsewhere; and check that the contents of these appear as expected, e.g. have not been changed by intruders.

One can think of a HIDS as an [[software agent|agent]] that monitors whether anything or anyone, whether internal or external, has circumvented the system's [[security policy]].

=== Monitoring dynamic behavior ===

Many computer users have encountered tools that monitor dynamic system behaviour in the form of [[anti-virus software|anti-virus]] (AV) packages. While AV programs often also monitor system state, they do spend a lot of their time looking at who is doing what inside a computer – and whether a given program should or should not have access to particular system resources. The lines become very blurred here, as many of the tools overlap in functionality.

[[Intrusion prevention systemssystem]]s are a type of HIDS software that protects against [[buffer overflow]] attacks on system memory and can enforce [[security policy]].<ref name=cox_gerg2004/>

=== Monitoring state ===

Line 51:

==See also==

* [[IBM Internet Security Systems]] – commercial HIDS / NIDS

* [[Intrusion detection system]] (IDS)

* [[Network intrusion detection system]] (NIDS)

* [[OSSEC]] – a multi-platform open source HIDS

* [[Tripwire (software)]] – commercial HIDS

* [[Trusted Computing Group]]

* [[Trusted platform module]]

* [[Verisys]] – commercial HIDS