Lecture 12 Intrusion Detection Systems

What is an NIDS?

• A software to detect inappropriate or malicious activity on a computer netork

• A software that has package payload analysis capabilities

• A software that has alerting capabilities whenever a malicious package is identified

• All answers are correct

Which kind of IDS systems exist?

• Host-based IDS

• Printer-based IDS

• Network-based IDS

• All answers are correct

Which of the following are NOT components of an IDS system?

• Traffic collector

• Indicator of compromise (IOCs) database

• Analysis engine

• User interface and reporting

Which four detection models exists for IDS systems?

• Behaviour based, signature based, cognitive based, temporary based

• Behaviour based, signature based, Anomaly based, artificial intelligence based

• Behaviour based, signature based, Anomaly based, Heuristic based

• Behaviour based, last access based, Anomaly based, derivative based

What's the main drawback of placing an NIDS behind the firewall?

• You will reduce the number of alarms

• You will see all traffic passed from the FW into the network

• You won't see attacks until they have breached the firewall

• All of them are drawbacks

Which are the two more popular open source NIDS tools?

• Falcon

• Snort

• Suricata

• Tetragon

What is a key difference between an NIPS and a NIDS?

• NIPS have an internal signature database

• NIPS can't analyze encrypted traffic

• NIPS must sit inline with the traffic

• NIPS can use both anomaly based and signature based detections.