IDS/IPS Identification

Let’s start with understanding what is IDS and IPS, and what’s the difference between the two of them, then we will talk about the tools.

IDS (Intrusion detection system)

IDS stands for Intrusion detection system. Its main function is to:

1. Monitor network traffic for suspicious activities and raise issues alerts when such activity is discovered
2. Regularly scans the network or a system for the harmful activity or breach of policy
3. Reports the malicious activity, either to an administrator or collected centrally using a security information and event management system (SIEM).

Even though the IDS protocol is quite standard for many servers, they often show false alarms. SO, it is the responsibility of the team and the admin to fine tune it and prevent such false alarms. It basically means properly setting up the intrusion detection systems to recognize what normal traffic on the network looks like as compared to malicious activity.

Basically there are 5 types of IDS:

1. Network IDS — Mainly deployed on the firewalls to protect them.
2. Host IDS —Deployed on machines, whose layout and organization is not supposed to change. If they are changed, the admin is alerted.
3. Protocol based IDS — You can see that in HTTP -> HTTPS
4. Application protocol based IDS— Deployed to prevent unwanted injections and man in the middle attacks on web servers.
5. Hybrid IDS — When you combine any two or more of them to protect your server, you have a hybrid IDS.

IPS (Intrusion Prevention System)

IPS stands for Intrusion Prevention System can be considered a part of IDS (Intrusion Detection System), because their work are quite similar. Both works to monitor network traffic to look for malicious activities. Major functions of intrusion prevention systems are to identify malicious activity, collect information about this activity, report it and attempt to block or stop it.

Some more function of IPS is to typically record information related to observed events, notify security administrators of important observed events and produce reports.

Many IPS can also respond to a detected threat by attempting to prevent it from succeeding. They use various response techniques, which involve the IPS stopping the attack itself, changing the security environment or changing the attack’s content.

Basic types of IPS includes:

1. Network based IPS — Monitors the entire network for suspicious traffic by analyzing protocol activity.
2. Network behavior analysis — Main focus on distributed denial of service attacks, specific forms of malware and policy violations
3. Wireless based IPS — Monitors a wireless network for suspicious traffic by analyzing wireless networking protocol.
4. Host Based IPS — Examines the activity of a single host for doubtful activity by scanning events that occur within that host.

Comparison of IPS with IDS:

The main difference between Intrusion Prevention System (IPS) with Intrusion Detection Systems (IDS) are:

1. Intrusion prevention systems are placed in-line and are able to actively prevent or block intrusions that are detected.
2. IPS can take such actions as sending an alarm, dropping detected malicious packets, resetting a connection or blocking traffic from the offending IP address.
3. IPS also can correct cyclic redundancy check (CRC) errors, de-fragment packet streams, mitigate TCP sequencing issues and clean up unwanted transport and network layer options.

Now, that we have the basic understanding of IDS/IPS, we can move forward to understanding those tools that will help us in recon whether the server is using IDS/IPS or not.