Detection type's of Intrusion Detection System (IDS)

 

An Intrusion Detection System (IDS) can use various detection methods to identify malicious activities. Here are two common types of IDS detection:

1. Signature-Based Detection

Description:

• Signature-based detection identifies malicious activity by comparing network traffic or system behavior against a database of known attack patterns or signatures.

Key Points:

• Signature Database: Uses predefined patterns or signatures of known threats to detect attacks. For example, a signature might match a specific sequence of bytes or a known exploit.
• Efficiency: Effective at detecting known threats and providing accurate alerts for attacks with well-documented signatures.
• Limitation: Ineffective against new, unknown threats or variations of known attacks that do not match existing signatures.

Example:

• Virus Detection: Detects known viruses by matching their specific code patterns or signatures.

2. Anomaly-Based Detection

Description:

• Anomaly-based detection identifies malicious activity by detecting deviations from established normal behavior or baseline patterns. It flags any activity that significantly deviates from the norm as potentially suspicious.

Key Points:

• Behavioral Baseline: Establishes a baseline of normal network or system behavior and monitors for deviations from this baseline.
• Flexibility: Capable of detecting previously unknown or novel attacks by identifying unusual or abnormal patterns of behavior.
• Limitation: May produce false positives if normal variations in behavior are mistakenly classified as anomalies, requiring fine-tuning of the baseline.

Example:

• Network Traffic Monitoring: Flags unusual spikes in network traffic or unusual access patterns that deviate from typical usage.

Summary

1. Signature-Based Detection: Detects known threats by matching patterns against a database of attack signatures.
2. Anomaly-Based Detection: Detects potential threats by identifying deviations from established normal behavior patterns.

To detect the attack described in the WION news article, where hackers temporarily shut down two advanced telescopes, the appropriate detection types would be:

1. Anomaly-Based Detection

Why It’s Relevant:

• Behavioral Deviations: Anomaly-based detection is well-suited for identifying unusual behavior or deviations from normal operational patterns. In this case, if the telescopes or their associated network systems were behaving unusually—such as unexpected shutdowns or unusual access patterns—anomaly-based IDS would detect these deviations from the norm.
• Unknown Threats: Given that the attack involved a new or unknown method of compromise, anomaly-based detection would be able to identify this as suspicious because it would deviate from the expected behavior of the telescopes and their control systems.

Application:

• Monitoring Telescope Operations: An anomaly-based IDS would monitor the regular operational patterns of the telescopes and flag any abnormal activities, such as unexpected shutdowns or changes in communication patterns, as potential threats.

2. Signature-Based Detection

Why It Might Also Be Relevant:

• Known Attack Patterns: If the attack used known malware or exploits with established signatures, signature-based detection could identify it by matching the attack against its database of known threats.
• Detection of Known Threats: If the hackers used known tools or methods to shut down the telescopes, signature-based IDS could potentially detect these based on known signatures of such tools.

Application:

• Malware Detection: If the attack involved deploying known malware or exploiting known vulnerabilities, signature-based IDS would scan for and detect these threats based on their signatures.

Summary

• Anomaly-Based Detection: Best suited for detecting the initial indication of the attack by identifying deviations from normal behavior, especially useful for detecting unknown or novel attack techniques.
• Signature-Based Detection: Useful if the attack involved known malicious tools or techniques with established signatures. It would help in identifying and confirming the specific nature of the attack if it matches known patterns.

In the context of the reported attack on the telescopes, anomaly-based detection would likely be the primary method for identifying unusual activities leading to the shutdowns, while signature-based detection could be used to verify and further analyze the nature of the attack if it involved known malicious software or techniques.