A survey of intrusion detection and prevention systems

Abstract

PurposeThe problem of protecting information and data flows has existed from the very first day of information exchange. Various approaches have been devised to protect and transfer such information securely. However, as technology and communications advance and information management systems become more and more powerful and distributed, the problem has taken on new and more complex dimensions and has become a major challenge. The widespread use of wired and wireless communication networks, internet, web applications and computing has increased the gravity of the problem. Organizations are totally dependent on reliable, secure and fault‐tolerant systems, communications, applications and information bases. Unfortunately, serious security and privacy breaches still occur every day, creating an absolute necessity to provide secure and safe information security systems through the use of firewalls, intrusion detection and prevention systems (ID/PSs), encryption, authentication and other hardware and software solutions. This paper aims to address these issues.Design/methodology/approachThis survey presents an up‐to‐date comprehensive state of the art overview of ID/PSs based on risk analysis, a description of what ID/PSs are, the functions they serve, its two primary types and different methods of ID that may employ.FindingsAs security incidents are increasing and are more aggressive, ID/PSs have also become increasingly necessary, they compliment the arsenal of security measures, working in conjunction with other information security tools such as malware filters and firewalls. Because of a growing number of intrusion events and also because the internet and local networks together with user applications have become so ubiquitous, the need arises to use sophisticated advanced techniques from autonomic computing, machine learning, artificial intelligence and data mining to make intelligent/smart ID/PSs.Originality/valueThis paper perceives the requirements of developing a new detection mechanism to detect known and unknown threats, based on intelligent techniques such as machine learning and autonomic computing.

Discovering New Cyber Protection Approaches from a Security Professional Prospective

“…IDS are an important tool because its impl anomaly behaviors and apply detection mechanisms to possibly detect unauthorized access or/and behavior that can compromise the system gap in the literature when it comes to understand how to identify the threats they may be facing and how their data need constant protection [1]. Implementing tools and techniques to ensure the integrity, availability, confidentiality, and accountability of the system are essential to the survival of the organization [59]. Observing such activities is crucial in identifying accurate attacks especially when it comes to false negative and positive alerts debated about the anomaly detection dilemma and concluded that alternatives have been elusive.…”

“…It is understood and expected that all aspects of the infrastructure are protected from any kind of breaches that would target and affect the security, integrity, availability, confidentiality of the organization stored data [59]. When analyzing IDS, its configuration may impair the detection of harmful actions [17].…”

“…In addition, well trained system analysts should be required monitor the system as well [59]. Hackers understand that the golden egg resides in the financial benefit of gaining access to those vulnerable infrastructure and data [50].…”

A Study of the Novel Approaches Used in Intrusion Detection and Prevention Systems

“…The aim of this paper [5] is to address the issues of information security because most of the organizations are depending on the internet to communicate with the people or with the systems to provide them news, online shopping, email, credit card detail and personal information. This paper [5] describes the security needs of an organization to protect their critical information from attacks.…”

“…This paper [5] describes the security needs of an organization to protect their critical information from attacks. A well trained staff and analyst are required to continuously monitoring the system.…”