How to deploy HIDS in the Solaris network environment (I)

Article Title: how to deploy HIDS in a Solaris network environment (I ). Linux is a technology channel of the IT lab in China. Includes basic categories such as desktop applications, Linux system management, kernel research, embedded systems, and open source.

1. NIDS-network-based IDS

Network Intrusion Detection System (NIDS) is generally composed of two parts: Network traffic sensor and Intrusion Detection System console. Network traffic sensors are generally deployed on the mirror port (SPAN) of the core switch or department switch in the Network Center. On the network security administrator's workstation, you can use the intrusion detection system console to receive and analyze logs sent from network sensors for alarm processing. You can also integrate the network traffic sensor and the intrusion detection system console on the same host for simultaneous detection and analysis.

　Advantages:

Low cost.

Activities that cannot be monitored by host-level IDS.

It is difficult for hackers to eliminate intrusion evidence.

Failed or malicious intrusion attacks can be detected.

It has nothing to do with the operating system.

　　Defects:

If the network size is too large, IDS will often be lost? Multiple packages, unable to fully monitor all data on the network.

To collect and analyze traffic on a large network, the CPU processing speed is usually more efficient and the memory is larger ?.

2. HIDS-host-based IDS

Host Intrusion Detection System (HIDS) is usually installed on the Host to be monitored, this module intelligently analyzes and judges the real-time network connection and system audit logs of the host. If the activity of a monitored object is suspicious, the intrusion detection system will take appropriate measures if it has certain characteristics or violates the daily statistical baseline.

　　Advantages:

Check whether the hacker has successfully intruded into the system.

Monitor the activity of a specific host system

Make up for network-level IDS Miss monitoring intrusion events

Is it suitable for encryption and switches? Switch? Environment

Real-Time (Near realtime) monitoring and response

No additional hardware required

　Defects:

Can all hosts be installed? Different versions or operating systems, which have different review records, are required? For different hosts? Various HIDS.

Intruders may intrude into other system vulnerabilities and obtain system administrator privileges. so? Jia? IDS loses its utility.

Host-based IDSs may be ineffective due to denial-of-service.

[1] [2] [3] [4] Next page