Intrusion Detection — Study Guide
Lecture 4 | Network Security
1. What is an Intrusion?
An intrusion is any activity that:
• Tries to access a system without permission
• Tries to damage, steal, or modify data
• Violates security policies
Intrusion Detection = monitoring a computer system/network to identify unauthorized access, misuse, or
attacks — usually via an IDS (Intrusion Detection System).
Types of Intruders
Type Goal Methods
Cyber Criminals Financial gain Identity theft, ransomware, phishing, data theft
Activists (Hacktivists) Promote ideology Website defacement, DDoS, data leaks
State-Sponsored (APTs) National interest / espionage Spy, steal secrets, disrupt infrastructure
Others (Hobby Hackers) Fun / curiosity Exploit freely available attack toolkits
■ Insider Attacks
Among the most difficult to detect. Motivated by revenge or entitlement.
Countermeasures:
• Enforce least privilege (only necessary access)
• Log user activity on a log server
• Strong authentication for sensitive resources
• On termination: immediately revoke access + mirror the hard drive (legal evidence)
2. Intrusion Techniques (Attack Phases)
1. Target Acquisition & Info Gathering
Identify the target, which systems are online, weak points. Techniques: port scanning, network
scanning, packet probing.
2. Initial Access
Enter the system via phishing, exploiting vulnerabilities, brute-force, or drive-by downloads.
3. Privilege Escalation
Move from normal user → administrator/root to access restricted files, install software, disable security
tools.
4. Information Gathering / System Exploit
Scan files, transfer documents externally, use captured passwords to reach more servers.
5. Maintaining Access
Install backdoors or create hidden admin accounts to persist even after reboots or password changes.
6. Covering Tracks
Delete/modify log files, change file timestamps to hide evidence and avoid detection.
3. Intrusion Detection System (IDS)
IDS is the second line of defense (after firewalls). It works on the principle that intruder behavior differs
measurably from legitimate user behavior.
Key Concepts
• False Positive: Normal behavior flagged as an attack
• False Negative: An actual attack is NOT detected
• These arise because intruder and normal behavior profiles overlap
IDS Requirements
1. Run continuously with minimal human supervision
2. Fault tolerant (recovers from crashes)
3. Self-protecting (resists tampering by attackers)
4. Minimal system overhead (no performance degradation)
5. Adapts to behavioral changes over time
Countermeasures Summary
• IDS — detects and alerts (does NOT block)
• IPS — detects AND automatically blocks malicious activity
• Restricting Remote Logons — whitelist IPs, use access control policies
• CERTs — collect vulnerability info, analyze threats, issue guidelines
4. IDS Analysis Approaches
A. Anomaly Detection
Learns normal behavior during a training phase, then flags deviations.
Sub-type How it works Pros Cons
Statistical Analyzes one metric at a time (login attempts,
Simple traffic) Misses complex patterns; high false positives
(Univariate)
Statistical Analyzes correlations between multiple
More
metrics
accurate
together More complex
(Multivariate)
Knowledge-Based Uses expert-defined rules (finite-state Robust,
machines)
flexible Needs human experts; can't cover all behaviors
Machine Learning AI models trained on historical data; auto-detect
Flexible, catches
anomalies
unknown
Expensive,
attacksneeds quality data, high false alarms
B. Signature / Heuristic Detection
• Signature Detection: Matches activity against a database of known attack patterns. Fast and
accurate for known threats but cannot detect zero-day attacks. Requires constant updates.
• Heuristic Detection: Uses behavior-based rules (not exact signatures). Can catch unknown threats
by flagging suspicious behavior patterns (e.g., modifying system files, disabling security software).
Quick Comparison Table
Type Main Idea
Statistical Anomaly Detects deviations using mathematical models
Knowledge-Based Anomaly Expert-defined rules detect abnormal behavior
Machine Learning Anomaly AI learns normal behavior automatically
Signature Detection Matches activity with known attack patterns
Heuristic Detection Rule-based behavior analysis flags suspicious actions
5. IDS Types by Deployment
Type Monitors Detects Example
HIDS Single host: External + internal Installed on a
(Host-Based) logs, files, attacks on that host Windows/Linux server
registry, syscalls
NIDS Network traffic Port scanning, DoS, Placed at router
(Network-Based) packet-by-packet malware comms, or firewall
in real time unauthorized access
Hybrid IDS Both host Broadest coverage Combines HIDS + NIDS
and network
IDS Logical Components
• Sensors — collect data from the system/network
• Analyzers — determine if an intrusion has occurred
• User Interface — view output and control system behavior
Data Sources Used by IDS Sensors
• Audit/Log file records (Windows, Linux)
• File integrity checksums (hash values — change = intrusion)
• Registry access monitoring (Windows)
• System call traces (unusual syscalls by a process)
6. Honeypots
A honeypot is a decoy system — it looks real and valuable but is isolated and monitored.
Purpose:
• Lure attackers away from real/critical systems
• Collect intelligence (attack techniques, tools, IPs)
• Keep attacker busy → gives defenders time to respond
Type Description Pros / Cons
Low-Interaction Software that emulates services/OS. Does NOT run a full OS. Safe, easy to deploy / Limited realism
High-Interaction A real system with full OS, services and applications. Very realistic, captures detailed intel / Resource-heavy; if compromised, can be used to attack others
7. Snort
Snort is an open-source, portable IDS that can function as both NIDS and HIDS.
• Open Source — free, publicly available source code
• Portable — runs on Linux, Windows, hosts, servers, routers
• Easy deployment — lightweight, installs on most network nodes
• Real-time packet capture — analyzes IP, TCP, UDP, HTTP protocols
• Detects attacks using a rule-based system (signature detection)
Key Terms to Know for the Exam
Intrusion: Unauthorized access, data damage/theft, or policy violation
IDS: Monitors and alerts — does NOT block
IPS: Monitors and automatically blocks
False Positive: Normal activity flagged as attack
False Negative: Attack goes undetected
APT: Advanced Persistent Threat — state-sponsored, long-term covert attack
Hacktivist: Activist hacker motivated by ideology
Honeypot: Decoy system to attract and study attackers
HIDS: Host-Based IDS — monitors one machine
NIDS: Network-Based IDS — monitors network traffic
Snort: Open-source rule-based IDS/NIDS tool
Privilege Escalation: Gaining higher rights than originally assigned
Covering Tracks: Deleting logs/timestamps to hide attack evidence
Anomaly Detection: Flags behavior deviating from a normal baseline
Signature Detection: Matches activity to known attack patterns
Good luck on your exam! ■