 sit inline and are passive. Some people see IPSs as next-generation IDS systems, because they take detection a step further, but others think in broader terms and consider the IPSs to be yet another tool in the security infrastructure that could help prevent intrusions. IPS has developed out of IDS, but they are really different security products that have different functionality and strengths.
There are two primary ways to collect data on a switched network: port mirroring and network taps. Port mirroring, also referred to as spanning, is when copies of incoming and outgoing packets are forwarded from one port of a network switch to another port where the packets can be analyzed. Network taps are put directly in-line of the network traffic, and they copy the incoming and outgoing packets and retransmit them back out on the network. Both methods have advantages and disadvantages that should be explored when making implementation decisions.
IPS systems are similar in setup to IDS systems—an IPS can be a host-based IPS (HIPS), which work best at protecting applications, or a network-based IPS (NIPS). User actions should correspond to actions in a predefined knowledge base; if an action isn’t on the accepted list, the IPS will prevent the action. Unlike an IDS, the logic in an IPS is typically applied before the action is executed in memory. Other IPS methods compare file checksums to a list of known good checksums before allowing a file to execute, and to work by intercepting system calls.
An IPS will typically consist of four main components:
The traffic normalizer will interpret the network traffic and do packet analysis and packet reassembly, as well as performing basic blocking functions. The traffic is then fed into the detection engine and the service scanner. The service scanner builds a reference table that classifies the information and helps the traffic shaper manage the flow of the information. The detection engine does pattern matching against the reference table, and the appropriate response is determined. Figure 1-3 outlines this process.
Figure 1-3: Standard IPS system
IDS and IPS technology each have their own place in a security program because they perform separate functions. Table 1-3 clarifies some of the differences between them.
Installed on network segments (NIDS) and on hosts (HIDS)
Installed on network segments (NIPS) and on hosts (HIPS)
Sits on network passively
Sits inline (not passive)
Cannot parse encrypted traffic
Better at protecting applications
Central management control
Central management control
Better at detecting hacking attacks
Ideal for blocking web defacement
Alerting product (reactive)
Blocking product (proactive)
Intrusion-prevention technology is fairly new and is still evolving, whereas intrusion detection has a bit more history behind it. However, both IDS and IPS have their roots in auditing. In 1980, James Anderson wrote a technical report called Computer Security Threat Monitoring and Surveillance for the U.S. Air Force. The paper showed that audit records could be used to help identify computer misuse and identify threat classifications, and it offered suggestions to improve auditing of systems to identify misuse.
In 1985, SRI International was funded by the U.S. Navy to develop intrusion-detection research. Dr. Dorothy Denning helped lead this team to develop a prototype that would analyze audit trails from government systems and track user activity. Her team named this system the Intrusion Detection Expert System (IDES), and it was the foundational research into IDS technology. One year later, in 1987, Dr. Denning published a paper called An Intrusion Detection Model for the 1986 IEEE Symposium on Security and Privacy that helped describe the basic workings of behavioral analysis. Behavioral analysis looks for deviations from the type of behavior that has been statistically baselined, such as relationships in packets and in what is being sent over a network.
While SRI was working on IDES for the Navy in 1987, Los Alamos National Laboratory was working on the Haystack proj