Protocol-based intrusion detection system: Difference between revisions

Revision as of 18:37, 14 February 2011

Revision as of 18:23, 26 August 2017

Line 1:

{{Unreferenced|date=December 2009}}

A '''protocol-based intrusion detection system''' ('''PIDS)''') is an [[intrusion detection system]] which is typically installed on a [[web server]], and is used in the monitoring and analysis of the [[Communications protocol|protocol]] in use by the computing system. A PIDS will monitor the dynamic behavior and state of the protocol and will typically consist of a system or agent that would typically sit at the front end of a server, monitoring and analyzing the communication between a connected device and the system it is protecting.

A typical use for a PIDS would be at the front end of a web server monitoring the [[HTTP]] (or [[HTTPS]]) stream. Because it understands the HTTP relative to the web server/system it is trying to protect it can offer greater protection than less in-depth techniques such as filtering by [[IP address]] or [[port number]] alone, however this greater protection comes at the cost of increased computing on the web server.

Line 12:

==See also==

* [[Application protocol-based intrusion detection system]] (APIDS)

* [[Host-based intrusion detection system]] (HIDS)

* [[Intrusion detection system]] (IDS)

* [[Network intrusion detection system]] (NIDS)

* [[Tripwire (software)]] -– a pioneering HIDS

* [[Host-based intrusion detection system]] (HIDS)

* [[Application protocol-based intrusion detection system]] (APIDS)

* [[Tripwire (software)]] - a pioneering HIDS

* [[Trusted Computing Group]]

* [[Trusted platform module]]