Comparison of the Host Based Intrusion Detection Systems and Network Based Intrusion Detection Systems

Abstract

Advanced Persistent Threat (APT) has recently emerged as sophisticated and tailor-made attacks. APTs pose threats mainly targeting military, defense, security infrastructure, high profile companies, and government units. Intrusion detection mechanisms are crucial for adequate protection, especially as a countermeasure for APT attacks done by hacktivists, cyber warriors, and cyber terrorists over management information systems (MIS) of government institutions and e-government applications. In this study, Intrusion detection and prevention systems have been studied in detail after being referred to the tasks and abilities of the intrusion detection systems that are at the core of the computer security technology presented today to meet the increasing need for information and network security. This paper aims to specify the differences between Host Based Intrusion Detection Systems (HIDS) and Network-Based Intrusion Detection Systems (NIDS) and compares the tools using HIDS and NIDS. It is asserted that to better assurance for APT attacks, there should be a Hybrid IDS approach covering both networks and hosts using both signature and behavioral detection mechanisms based on deep learning algorithms.

Building an effective network security system of the enterprise based on the method of analyzing hierarchies of quality indicators

“…Стаття [6] має на меті визначити відмінності між системами виявлення вторгнень на основі хоста (HIDS) і мережевими системами виявлення вторгнень (NIDS) і порівняти інструменти, які використовують HIDS і NIDS. Стверджується, що для кращої гарантії APTатак має бути гібридний підхід IDS, який охоплює як мережі, так і хости, використовуючи як сигнатурні, так і поведінкові механізми виявлення на основі алгоритмів глибокого навчання.…”

Intrusion Detection Systems: Categories, attack detection and response.

“…On the other hand, if the system will give an allert, there is high probability of its accurance. Therefore it limits False Positive alerting, opposite to Anomaly-based detection systems [8].…”

Risk-Based System-Call Sequence Grouping Method for Malware Intrusion Detection

“…An intrusion-detection system (IDS) is a device or software that monitors a network or system for malicious activity or violations of established policies [1]. IDSs can be divided into two major types [1]: network-based intrusion-detection systems (NIDSs) [2] and host-based intrusion-detection systems (HIDSs) that detect malware or host-level attacks on a server or local computer and are able to perform additional system-level checks such as data integrity, registry monitoring, log analysis, rootkit detection and system-call analysis [2] and complement network-based intrusion-detection systems by focusing on internal threats and unauthorized activities [3]. HIDSs can detect various types of attacks, including malware infections, unauthorized access attempts, privilege escalation, and suspicious system modifications [4].…”