Practical UNIX and Internet Security, 3rd Edition

Intrusion Detection Systems

Another proactive approach to defending a Unix host is to monitor it for suspicious activity and take action when any is detected. An intrusion detection system (IDS) is a program (or set of programs) designed to monitor the system and report or respond to untoward activity.

An IDS can monitor activity on a single host, activity on multiple hosts, or activity on a network. An IDS can characterize an activity as suspicious either because it is anomalous (differs from a user’s usual activity) or because it matches a set of known characteristics of system misuse (or attack).

Host-based IDS

Host-based intrusion detection systems typically monitor system log files and other audit trails and respond to unusual activity. For example, an IDS may notice when a user logs in from an unusual host or at an unusual time, or when a user’s shell history file is truncated (an act typical of an attacker covering his trail). The IDS may respond by alerting the system administrator, or may take more aggressive action such as disabling the user’s account.

Some host-based IDS systems can monitor log files collected from multiple hosts (either through syslog’s remote-logging capability or through a client/server architecture built into the IDS). Such multihost IDS systems are convenient for administrators who are responsible for large networks of hosts.

Network-based IDS

Network-based intrustion detection systems (NIDSs) monitor network packets rather than (or in addition to) ...