Protocol-based intrusion detection system: Difference between revisions

Revision as of 22:33, 12 September 2009

Revision as of 10:48, 27 November 2009

Line 1:

A '''protocol-based intrusion detection system (PIDS)''' is an [[intrusion detection system]] which is typically installed on a [[web server]], and is used in the monitoring and analysis of the [[Communications protocol|protocol]] in use by the computing system. A PIDS will monitor the dynamic behavior and state of the protocol and will typically consist of a system or agent that would typically sit at the front end of a server, monitoring and analyzing the communication between a connected device and the system it is protecting.

A typical use for a PIDS would be at the front end of a web server monitoring the [[HTTP]] (or [[HTTPS]]) protocol stream. Because it understands the HTTP protocol relative to the web server/system it is trying to protect it can offer greater protection than less in-depth techniques such as filtering by [[IP address]] or [[port number]] alone, however this greater protection comes at the cost of increased computing on the web server.

Where HTTPS is in use then this system would need to reside in the "shim" or interface between where HTTPS is [[Cryptography|un-encrypted]] and immediately prior to it entering the Web [[presentation layer]].