GUIDE TO INTRUSION DETECTION AND PREVENTION SYSTEMS (IDPS)
Table of Contents
Executive Summary..............................................................................................................ES-1
1. Introduction ......................................................................................................................1-1
1.1 Authority...................................................................................................................1-1
1.2 Purpose and Scope .................................................................................................1-1
1.3 Audience..................................................................................................................1-1
1.4 Document Structure.................................................................................................1-1
2. Intrusion Detection and Prevention Principles .............................................................2-1
2.1 Uses of IDPS Technologies.....................................................................................2-1
2.2 Key Functions of IDPS Technologies ......................................................................2-2
2.3 Common Detection Methodologies..........................................................................2-3
2.3.1 Signature-Based Detection...........................................................................2-4
2.3.2 Anomaly-Based Detection............................................................................2-4
2.3.3 Stateful Protocol Analysis.............................................................................2-5
2.4 Types of IDPS Technologies ...................................................................................2-6
2.5 Summary..................................................................................................................2-7
3. IDPS Technologies...........................................................................................................3-1
3.1 Components and Architecture .................................................................................3-1
3.1.1 Typical Components.....................................................................................3-1
3.1.2 Network Architectures ..................................................................................3-1
3.2 Security Capabilities ................................................................................................3-2
3.2.1 Information Gathering Capabilities ...............................................................3-2
3.2.2 Logging Capabilities .....................................................................................3-2
3.2.3 Detection Capabilities...................................................................................3-3
3.2.4 Prevention Capabilities.................................................................................3-4
3.3 Management............................................................................................................3-4
3.3.1 Implementation.............................................................................................3-4
3.3.2 Operation and Maintenance .........................................................................3-6
3.3.3 Building and Maintaining Skills.....................................................................3-9
3.4 Summary................................................................................................................3-10
4. Network-Based IDPS........................................................................................................4-1
4.1 Networking Overview ...............................................................................................4-1
4.1.1 Application Layer..........................................................................................4-1
4.1.2 Transport Layer ............................................................................................4-2
4.1.3 Network Layer ..............................................................................................4-2
4.1.4 Hardware Layer............................................................................................4-3
4.2 Components and Architecture .................................................................................4-3
4.2.1 Typical Components.....................................................................................4-3
4.2.2 Network Architectures and Sensor Locations...............................................4-4
4.3 Security Capabilities ................................................................................................4-7
4.3.1 Information Gathering Capabilities ...............................................................4-7
4.3.2 Logging Capabilities .....................................................................................4-8
4.3.3 Detection Capabilities...................................................................................4-9
4.3.4 Prevention Capabilities...............................................................................4-12
4.4 Management..........................................................................................................4-13
v
