ect, which produced an IDS system that could analyze audit data against defined patterns. Several people from the Haystack project worked with designers and developers from University of California-Davis and Lawrence Livermore National Laboratory (and later Trident Data Systems) to develop an IDS called the Distributed Intrusion Detection System (DIDS) for the U.S. Air Force. DIDS became the basis for a commercial IDS (Net Stalker), with similar functionality, by Haystack Labs.
In 1989, Todd Heberlein, a student at the University of California, Davis, built an IDS system called Network System Monitor (NSM). NSM was different from IDES and DIDS in that it would analyze network traffic rather than system logs. NSM, along with the now commercially available Stalker IDS, helped to create new awareness and interest in IDS research for the commercial and public sectors.
The 1990s saw a great deal of improvement of and interest in IDS technology. The U.S. Air Force commissioned Science Applications International Corporation (SAIC) to develop the Computer Misuse Detection System (CMDS). Marcus J. Ranum created a commercial IDS called Network Flight Recorder (NFR). Christopher Klaus and Thomas E. Noonan founded Internet Security Systems (ISS) and released a network-based intrusion-detection system called RealSecure. In addition, the U.S. Air Force Cryptologic Support Center created an IDS system called Automated Security Incident Measurement (ASIM), which was the first IDS to incorporate both software- and hardware-based solutions. Some of the developers of ASIM formed the Wheel Group and commercialized the product. Cisco Systems acquired the Wheel Group in 1998, which ultimately led to Cisco Systems developing IDS to be included in their routers functionality. During this time, Haystack Labs and the former development team for SAIC merged to form the Centrax Corporation, and it released host-based intrusion detection for Windows NT called eNTrax.
Starting in the late 1990s, intrusion prevention emerged. In the beginning, just detectingattacks was a huge undertaking, but as that discipline matured, it was clear that we needed to go beyond detection and prevent attacks in real time. The ISS RealSecure product had some features such as the rs-kill feature that would “kill” or stop traffic based on specific patterns. In 1998, SNORT, an open source libpcap-based packet sniffer and logger, which can be used as a lightweight NIDS and was developed by Marty Roesch, was made available and allowed many people to use and become familiar with intrusion detection. In 1999, Okena Systems created one of the first IPSs called StormWatch based on their INCORE architecture (Intercept Correlate Rules Engine), which intercepts file and network actions and correlates rules and application states to make real-time decisions based on application behavior. Okena was acquired by Cisco Systems in 2003. The development of intrusion prevention has just begun.
Libpcap is a system-independent interface for user-level packet capture, and it provides a portable framework for low-level network monitoring. Applications for libpcap include network statistics collection, security monitoring, network debugging, and so on.
IDSs and IPSs are important for many organizations, from small offices to large multinational corporations. IDSs and IPSs offer many benefits:
These are all very good reasons to implement these technologies, but there are three main reasons that justify the need more than the others:
IDSs and IPSs perform analyses, and it is important to understand the analysis process: what analysis does, what types of analysis are available, and what the advantages and disadvantages of different analysis schemes are.
Analysis, in the context of intrusion detection and prevention, is the organization of the constituent parts of data and their interrelationships to identify any anomalous activity of interest. Real-time analysis is analysis done on the fly as the data travels the path to the network or host. This is a bit of a misnomer, however, as analysis can onl