Application protocol-based intrusion detection system: Difference between revisions

Revision as of 17:18, 17 December 2006

Revision as of 18:34, 28 March 2007

Line 9:

As a basic level an APIDS would look for, and enforce the correct (legal) use of the protocol.

However at a more advanced level the APIDS can learn, be taught or even reduce what itis often an infinite protocol set, to an acceptable understanding of the [[subset]] of that application protocol that is used by the application being monitored/protected.

Thus, an APIDS, correctly configured, will allow an application to be "[[fingerprint]]ed", thus should that application be subverted or changed, so will the fingerprint change.