When operating one or more servers, it is advisable to secure your services against attacks and monitor them to uphold the objectives of information security (confidentiality, availability, and integrity). In addition to manual, recurring measures—such as active patch management or regular security audits—a Intrusion Detection System (IDS) for detection and a Intrusion Prevention System (IPS) can be used to prevent attacks on internal IT systems.
What types of intrusion detection systems are available?
Network-Based Intrusion Detection Systems (NIDS) have long proven to be the method of choice for analyzing network traffic. In this approach, network traffic is analyzed at a central location using signature-based detection. A key advantage of this approach is its independence from the specific software and hardware used on clients and servers. NIDS primarily consist of hardware-based components that are connected, for example, behind a firewall to analyze network traffic.
However, the increasing use of encryption makes it more difficult to employ this type of intrusion detection—or at least limits its areas of application. In addition, the bandwidth of the unit being monitored may exceed the bandwidth of the NIDS, requiring packets to be discarded or traffic to be throttled.
Due to these limitations and the predominantly centralized architecture of NIDS, current research focuses primarily on Host-Based Intrusion Detection Systems (HIDS). The analysis no longer takes place within the network components but rather through the evaluation of system calls or logs from individual services. As a result, the information collected is significantly more comprehensive than with NIDS. Furthermore, due to their decentralized architecture, HIDS are more scalable than NIDS. To handle the analysis of this large volume of data, machine learning is increasingly being used for anomaly detection.
How Host-Based Intrusion Detection Systems Work
The HIDS requires access to all logs to be analyzed in order to evaluate them.
HIDS systems support service administration by compiling and visualizing the data generated during analysis into reports at regular intervals. The analyzed log data is scanned for anomalies and logged for later review. This simplifies the search process and prevents the need to painstakingly search through the log data of individual services in the event of a compromise. The collected data not only helps secure services against unauthorized access but also aids in troubleshooting when individual system components or services fail.
All of this can only work if the HIDS has been configured correctly. This includes regularly reviewing the detection settings in light of the company's evolving environment.
For better protection, it is recommended not to rely on just one technology, but to use a combination of HIDS and NIDS, since neither system alone can provide comprehensive protection. NIDS can immediately trigger an alarm in the event of short-term anomalies in the network, while HIDS can shed light on more complex and long-term attack vectors.
IDSs can be divided into two categories based on how they work: anomaly detection and signature detection.
Anomaly detection works by analyzing network traffic, system calls, or logs to identify deviations from historical or defined normal states.
Signature detection, on the other hand, relies on predefined characteristics that are indicative of specific attack scenarios. An example of this is the Leipzig Intrusion Detection – Dataset (LID-DS): https://github.com/LID-DS/LID-DS.
The LID-DS is a dataset that contains known attack patterns. It also features a framework for adding additional attack patterns. A distinction is made between „Simple“ requests, which represent a direct attack step, and „Multi“ requests, which are part of a longer chain of requests for an attack.
In addition to this research project, there are a number of HIDS tools that offer a wide range of features and are actively being further developed. The market landscape is very diverse and offers solutions for organizations of all sizes.
Difference Between IDS and SIEM
Those with an interest in security will have already noticed that the way IDS works overlaps in some areas with SIEM.
SIEM stands for Security Information and Event Monitoring. These systems are designed as a comprehensive approach to monitoring an organization’s hardware and software infrastructure for undesirable conditions.
Like a HIDS, a SIEM aggregates information from various sources into a comprehensive overview. The difference, however, lies in the diversity of the input data it accepts. Data sources can include servers, hardware components in the network topology, and both NIDS and HIDS. Thus, a SIEM combines the functionalities of NIDS and HIDS and serves as a consolidating entity for them. In this regard, SIEMs are a scalable option for unifying various existing data sources and expanding them with system-specific agents.
This makes SIEM a crucial layer in the process of monitoring a company’s own systems, enabling the aggregation of important real-time information and a timely response to anomalies.
Summary
Host-based intrusion detection is a useful complement to network-based protection and monitoring mechanisms. For HIDS to function, they require access to the resources of the services. As a result, setting up and maintaining a HIDS involves a certain amount of effort. In return, you receive automated reports on the status of the services in operation and can identify threats without having to painstakingly sift through logs. In a growing corporate structure, a HIDS can help keep track of the systems under management. As requirements increase, it can also be supplemented with a SIEM.
