ined. Figure 1-3 outlines this process.
Figure 1-3: Standard IPS system
IDS and IPS technology each have their own place in a security program because they perform separate functions. Table 1-3 clarifies some of the differences between them.
Installed on network segments (NIDS) and on hosts (HIDS)
Installed on network segments (NIPS) and on hosts (HIPS)
Sits on network passively
Sits inline (not passive)
Cannot parse encrypted traffic
Better at protecting applications
Central management control
Central management control
Better at detecting hacking attacks
Ideal for blocking web defacement
Alerting product (reactive)
Blocking product (proactive)
Intrusion-prevention technology is fairly new and is still evolving, whereas intrusion detection has a bit more history behind it. However, both IDS and IPS have their roots in auditing. In 1980, James Anderson wrote a technical report called Computer Security Threat Monitoring and Surveillance for the U.S. Air Force. The paper showed that audit records could be used to help identify computer misuse and identify threat classifications, and it offered suggestions to improve auditing of systems to identify misuse.
In 1985, SRI International was funded by the U.S. Navy to develop intrusion-detection research. Dr. Dorothy Denning helped lead this team to develop a prototype that would analyze audit trails from government systems and track user activity. Her team named this system the Intrusion Detection Expert System (IDES), and it was the foundational research into IDS technology. One year later, in 1987, Dr. Denning published a paper called An Intrusion Detection Model for the 1986 IEEE Symposium on Security and Privacy that helped describe the basic workings of behavioral analysis. Behavioral analysis looks for deviations from the type of behavior that has been statistically baselined, such as relationships in packets and in what is being sent over a network.
While SRI was working on IDES for the Navy in 1987, Los Alamos National Laboratory was working on the Haystack project, which produced an IDS system that could analyze audit data against defined patterns. Several people from the Haystack project worked with designers and developers from University of California-Davis and Lawrence Livermore National Laboratory (and later Trident Data Systems) to develop an IDS called the Distributed Intrusion Detection System (DIDS) for the U.S. Air Force. DIDS became the basis for a commercial IDS (Net Stalker), with similar functionality, by Haystack Labs.
In 1989, Todd Heberlein, a student at the University of California, Davis, built an IDS system called Network System Monitor (NSM). NSM was different from IDES and DIDS in that it would analyze network traffic rather than system logs. NSM, along with the now commercially available Stalker IDS, helped to create new awareness and interest in IDS research for the commercial and public sectors.
The 1990s saw a great deal of improvement of and interest in IDS technology. The U.S. Air Force commissioned Science Applications International Corporation (SAIC) to develop the Computer Misuse Detection System (CMDS). Marcus J. Ranum created a commercial IDS called Network Flight Recorder (NFR). Christopher Klaus and Thomas E. Noonan founded Internet Security Systems (ISS) and released a network-based intrusion-detection system called RealSecure. In addition, the U.S. Air Force Cryptologic Support Center created an IDS system called Automated Security Incident Measurement (ASIM), which was the first IDS to incorporate both software- and hardware-based solutions. Some of the developers of ASIM formed the Wheel Group and commercialized the product. Cisco Systems acquired the Wheel Group in 1998, which ultimately led to Cisco Systems developing IDS to be included in their routers functionality. During this time, Haystack Labs and the former development team for SAIC merged to form the Centrax Corporation, and it released host-based intrusion detection for Windows NT called eNTrax.
Starting in the late 1990s, intrusion prevention emerged. In the beginning,