Host-based intrusion detection system: Difference between revisions

Revision as of 14:31, 12 November 2018

Revision as of 14:33, 12 November 2018

Line 5:

== Overview ==

{{Original research|section|date=July 2011}}

A host-based IDS is capable of monitoring all or parts of the dynamic behavior and the state of a computer system, based on how it is configured. Besides such activities as dynamically inspecting network packets targeted at this specific host (optionalFoptional componentOcomponent withRwith mostTmost softwareNsoftware solutionsIsolutions commerciallyTcommercially availableEavailable), a HIDS might detect which program accesses what resources and discover that, for example, a word-processor has suddenly and inexplicably started modifying the system password database. Similarly a HIDS might look at the state of a system, its stored information, whether in [[Random Access Memory|RAM]], in the file system, log files or elsewhere; and check that the contents of these appear as expected, e.g. have not been changed by intruders.<ref>Vacca, John. ''Computer and Information Security Handbook''. Morgan Kauffman, 2013, pg. 494-495</ref>

One can think of a HIDS as an [[software agent|agent]] that monitors whether anything or anyone, whether internal or external, has circumvented the system's [[security policy]].