Host-based intrusion detection system: Difference between revisions

Revision as of 14:14, 18 December 2022

Revision as of 18:49, 7 February 2023

Line 4:

{{Information security}}

A '''host-based intrusion detection system''' ('''HIDS''') is an [[intrusion detection system]] that is capable of monitoring and analyzing the internals of a computing system as well as the [[network packet]]s on its network interfaces, similar to the way a network-based intrusion detection system (NIDS) operates.<ref name=newman2009/> This was the first type of intrusion detection [[software]] to have been designed, with the original target system being the [[mainframe computer]] where outside interaction was infrequent.<ref name=cn31_8_805/>

== Overview ==

{{Original research|section|date=July 2011}}

A host-based IDS is capable of monitoring all or parts of the dynamic behavior and the state of a [[Computer System|computer system]], based on how it is configured. Besides such activities as dynamically inspecting network packets targeted at this specific host (optional component with most software solutions commercially available), a HIDS might detect which program accesses what resources and discover that, for example, a word-processor has suddenly and inexplicably started modifying the system password database. Similarly a HIDS might look at the state of a system, its stored information, whether in [[Random Access Memory|RAM]], in the file system, log files or elsewhere; and check that the contents of these appear as expected, e.g. have not been changed by intruders.<ref>Vacca, John. ''Computer and Information Security Handbook''. Morgan Kauffman, 2013, pp. 494–495</ref>

One can think of a HIDS as an [[software agent|agent]] that monitors whether anything or anyone, whether internal or external, has circumvented the system's [[security policy]].

=== Monitoring dynamic behavior ===

Many computer users have encountered tools that monitor dynamic system behaviourbehavior in the form of [[anti-virus software|anti-virus]] (AV) packages. While AV programs often also monitor system state, they do spend a lot of their time looking at who is doing what inside a computer – and whether a given program should or should not have access to particular system resources. The lines become blurred here, as many of the tools overlap in functionality.

Some [[intrusion prevention system]]s protect against [[buffer overflow]] attacks on system memory and can enforce [[security policy]].<ref name=cox_gerg2004/>

Line 31:

For each object in question a HIDS will usually remember its attributes (permissions, size, modifications dates) and create a [[checksum]] of some kind (an [[MD5]], [[SHA1]] hash or similar) for the contents, if any. This information gets stored in a secure database for later comparison (checksum database).

An alternate method to HIDS would be to provide NIDS type functionality at the network interface (NIC) level of an end-point (either server, workstation or other end device). Providing HIDS at the network layer has the advantage of providing more detailed logging of the source (IP address) of the attack and attack details, such as packet data, neither of which a dynamic behavioral monitoring approach could see.

==== Operation ====

At installation time – and whenever any of the monitored objects change legitimately – a HIDS must initialize its checksum-database by scanning the relevant objects. Persons in charge of computer security need to control this process tightly in order to prevent intruders making un-authorized changes to the [[Database|database(s)]]. Such initialization thus generally takes a long time and involves [[cryptography|cryptographically]] locking each monitored object and the checksum databases or worse. Because of this, manufacturers of HIDS usually construct the object-database in such a way that makes frequent updates to the checksum database unnecessary.

Computer systems generally have many dynamic (frequently changing) objects which intruders want to modify – and which a HIDS thus should monitor – but their dynamic nature makes them unsuitable for the checksum technique. To overcome this problem, HIDS employ various other detection techniques: monitoring changing file-attributes, log-files that decreased in size since last checked, and numerous other means to detect unusual events.