Everybody welcome to the next video.
So in this video we're gonna be talking about an ISIS or an intrusion detection system.
Now what this type of system is it's used to identify possible attacks or intrusions on either a network
or a host.
Now this an I.D. will use a few different things solely to do rules or signatures which is based on
MDT FIVE HASHES or string pattern matching or something that they can check in a packet to a particular
amount of text of some kind to determine whether or not it's a malicious attack or heuristics where
it sort of keeps track of the connection learns what it's doing looking for suspicious things.
It's still based on some sort of recognition however heuristics tends to learn on its own what's bad
what's good based on you as an administrator flagging something that's bad or good.
Now ideas will just notify the administrator when a security event occurs.
Now security event could be anything from it seeing a net cat or shell session pop across the network
or to a cross site scripting attack flowing through or anything else along those lines.
Any any type of traffic that it seems malicious is called a security event.
Now there's two types of ideas.
There's host based in network based host based reside on workstations or the server.
So the actual hosts themselves.
This helps detect things in the attacks and security events not on the system or not on the network
but on the system.
So when things are attacking the system itself such as let's say a user is trying to load up a reverse
shell from the system and ideas that's installed on that particular machine will be able to trigger
depending on how the attack was done whether or not there was a security event and what it was.
These type of things can look in the memory file systems network connections anything it needs to.
They normally set at a very very low level like on Windows machines is going to be system on Linux it's
going to be a route now an example of this is carbon black carbon but can be used in a lot of different
ways.
I'm not going to go too much into what it is but it can be used for a lot of things including intrusion
detection.
Now there's network base.
This normally resides on a tap on the network so a tap is a physical device that's popped into a physical
wire or a physical network medium on the network.
So normal is the backbone of the network when it with the network comes in and what the tap does is
it duplicates the signal going across the wire off taps so you can instead of interacting with the traffic
all you're doing is looking and inspecting the traffic.
This is important because if you start putting things in between the firewall and the Internet as an
example and it has to inspect every packet you might run into a bottleneck where path traffic can't
pass fast enough and it causes a slowdown so a good example of this is something called bro ideas.
So this has just been a quick high view of IDF systems understand that enterprise networks you're going
to find at least one in most cases on smaller networks.
Companies tend to not even bother with ideas.
But keep in mind that they are there and you can trip an alarm if you're not careful when looking at
an IDF system.