Compare and Contrast Three Intrusion Detection Systems (IDS)
Devon Hopkins
Webster University

Introduction In the today’s society security is of paramount importance, whether it’s your business, home, vehicle, or computer. Companies are responsible for securing their employees, work area and the technology they use to operate their business. On a daily basis companies are under attack making them vulnerable to more and more worms, viruses, denial of service (DoS) attacks and hacking, shutting them down for various periods of times. With the advance technology more and more companies are storing information digitally. Having unsecure networks are leading to enormous amount of private information being public. The networks should protect data and maintain confidentiality, integrity and availability of the network. Companies should implement intrusion detection systems (IDS) because hackers are smarter and their intrusions are getting harder to trace.
Intrusion Detection System An intrusion detection system or IDS is a system that attempts to identify intrusions, which can be defined to be unauthorized uses, misuses, or abuses of the computer systems by either authorized users or external perpetrators [1]. The in the past the major ways that intrusion detection systems were described were host based IDS (HIDS) and network based IDS (NIDS). An addition to the IDS family is perimeter intrusion detection systems (PIDS). A perimeter intrusion detection system will be installed within the isolation zone to detect the presence of individuals or vehicles [3]. In parallel to rigorous investigation into intrusion prevention such as firewall and cryptography, the significance of research into IDS has been growing and various approaches have been suggested and developed [1].

Host based Intrusion Detection Systems
HIDS is used on host(s) to monitor, audit and detect incidents for the system(s) that they are running on. Host-based IDSs operate on information collected from within an individual computer system [8]. The systems were designed to prevent insiders from interrupting service but do not prevent individuals from outside to carry out an intrusion. On a HIDS there are multiple computers being monitored at the same time. This is needed to provide a visual for all possible intrusion points Host based IDSs look for changes in file attributes (create, modify, delete)[7].
Network based Intrusion Detection Systems NIDS monitors network traffic looking for patterns of denial of service. Network-based IDS can monitor the network traffic affecting multiple hosts that are connected to the network segment, thereby protecting those hosts [8]. The attacks are detected by capturing and analyzing network packets. Network IDs must match known and unknown attack strategies against their knowledge base to determine where and attack has occurred [7].
Perimeter Intrusion Detection Systems (PIDS)
Perimeter Intrusion Detection Systems is a complex commingling of multiple systems that provides advanced warning and threat assessment [4]. Physical controls and are put in place to ensure confidentiality, integrity, and availability. PIDS is a fast emerging application often deployed to prevent intrusion of unauthorized personnel into secure areas such as airports, maximum-security detention centers, nuclear facilities and more [4].

Compare and Contrast
Host intrusion detection system [6]: Host-based systems provide poor real-time response and cannot effectively protect against one-time catastrophic events. They are, however, excellent at detecting and responding to long term attacks, such as data thieving or disgruntled employees. Host-based systems stand out when it comes to determining the extent of a compromise after loss. They usually maintain large databases that indicate historical information that could serve as evidence in the prosecution of the misuser. Host-based [8] measure whether an attack was successful or not with greater accuracy and fewer false positives can network-based systems. Host-based IDS monitor user and file access activity, including file accesses, changes to file permissions, attempts to install new executables and/or attempts to access privileged services. Host-based systems can detect attacks that cannot be seen by network-based products. Host-based intrusion detection does not offer true real-time response; it can come extremely close if implemented correctly. Host-based intrusion detection resides on existing network infrastructure, including file servers, Web servers, and other shared resources. Host-based intrusion detection systems, on the other hand, are often priced in the hundreds of dollars for a single agent and can be deployed by a customer with limited initial capital outlay.

Network intrusion detection systems [6]: Network intrusion detection is the exact opposite. It is effective at real-time detection and response as it pertains to the network. Network intrusion detection can also be effective at detecting long-term attacks suck as sniffer programs regularly reporting information from outside the firewall. Network intrusion detection can be used to trace a series of connections through a network. This could be helpful in finding the misuser to whom the evidence from the host-based system can be attributed to. [8]: Network-based systems do not require software to be loaded and managed on a variety of hosts. Since fewer detection points are required, the cost of ownership is lower for an enterprise environment. Network-based IDS examine all packet headers for signs of malicious and suspicious activity. Network-based IDS use live network traffic for real-time attack detection. Network-based IDS detect malicious and suspicious attacks as they occur, and so provide faster notification and response. Network-based IDS add valuable data for determining malicious intent. Network-based IDS are not dependent on host operating systems as detection sources.

Perimeter intrusion detection system [3]: objective is to deter, delay, detect, assess, and track, potential or actual breaches of the perimeter in a proactive manner, enhance the efficiency of security personnel in responding to security breaches, and provide a high level of protection for persons and property within the secured areas of an airport.

Table 1-1 Comparative Analysis of Host, Network and Perimeter Intrusion Detection Systems | HIDS | NIDS | PIDS | Assets protected | Verifies success or failure of an attack | Detects unsuccessful attacks and malicious intent | Detects attempts to break through walls | Cost to implement | Lower cost of entry | Lowers cost of ownership | Low Cost of installation | Performance | Well-suited for encrypted and switched environments | More difficult for an attacker to remove evidence | Microprocessor controlled system adapts tochanging environmental conditions | Uses | Near-real-time detection and response | Real-time detection and response | Monitors signals generated by movementscaused by an intruder attempting to cut orclimb the perimeter fence | Vulnerabilities addressed | Detects attacks that network-based systems miss | Detects attacks that host-based systems miss | Enhanced reliability |
Host based and Network based analysis provided by [10].
Perimeter analysis provided by [5].VAN ENCING & SECURITY TECHNOLOGIES DVANCED FENCING & S
ECURITY TECHNOLOGI
ES LTD
Conclusion
Intrusion can occurs whether it is on a host, network or on the perimeter. These areas are becoming more and more targets. Host-based systems are designed more to deter insiders, but can’t effectively deter outsiders [6] Network intrusion detection systems NIDS) are considered an effective second line of defense against network-based attacks directed at computer systems [2]. Perimeter intrusion detection systems rely on dual technology to strengthen intrusion detection, and reduce false alarms [9]. Host based intrusion detection systems detects insider misuse while network intrusion detection systems detects outsider misuse and perimeter intrusion detects intrusion to buildings and critical infrastructures. Companies need to have reliable methods to detect attacks, mitigate vulnerabilities and protect their assets.

Works Cited

[1] B. Mukherjee, L.T. Heberlein. and K.N. Levitt. (1994, May/June). Network Intrusion Detection. IEEE Network , 8, pp. 24-41.
[2] Bace, R. (2000). Intrusion Detection. McMillian .
[3] Barnard, R. l. (1988). Intrusion Detection Systems, Second Edition. Newton: Butterworth-Heinemann.
[4] Fijitsu. (2006). Perimeter Intrusion Detection Systems (PIDS). Texas: Fijitsu Network Communications, Inc.
[5] G.M. Advance Fencing & SecurityTechnologies LTD. (n.d.). Retrieved from www.gmsecurity.com/V- ALERT%20PERIMETER.pdf.
[6] Kozushko, H. (2003). Intrusion Detection Systems: Host-Based and Network-Based Intrustion Detection Systems.
[7] Mattord, Michael E. Whitman and Herbert J. (2008). Management of Imformation Security. Boston: Course technology, Cengage Learning.
[8] NIST. Intrustion Detection Systems sp800-31.
[9] Purpura, P. P. (2007). Terriosm and Homeland Security: an introduction with applications. Burlington: Elsevier, Inc.
[10] Systems, Internet Security. (1998). Network-vs. host-based intrusion Detection: A Guide to Intrusion setection technology. Atlanta.