Shulou(Shulou.com)06/02 Report--

This article mainly introduces why the intrusion detection system can be divided according to the source of detection data. The article is very detailed and has a certain reference value. Interested friends must finish reading it!

According to the source of detection data, intrusion detection system can be divided into network-based IDS and host-based IDS. Intrusion detection system (IDS) is a kind of network security device that monitors the network transmission immediately, issues the alarm or takes the active response measure when the suspicious transmission is found.

According to the source of detection data, intrusion detection system (IDS) can be divided into network-based IDS and host-based IDS.

What is an intrusion detection system?

Intrusion detection system (intrusion detection system, referred to as "IDS") is a kind of network security device that monitors the network transmission immediately, issues the alarm or takes the initiative response measure when discovering the suspicious transmission. It is different from other network security devices in that IDS is an active security protection technology. IDS first appeared in April 1980. In the mid-1980s, IDS gradually developed into an intrusion detection expert system (IDES). In 1990, IDS was divided into network-based IDS and host-based IDS. Then came the distributed IDS. At present, with the rapid development of IDS, it has been claimed that IDS can completely replace the firewall.

IETF divides an intrusion detection system into four components:

An event generator (Event generators), which aims to obtain an event from the entire computing environment and provide it to the rest of the system.

Event analyzer (Event analyzers), which obtains the data after analysis and produces the analysis results.

The response unit (Response units), which is a functional unit that responds to the analysis results, can make strong reactions such as cutting off connections and changing file attributes, or it can simply give an alarm.

Event database (Event databases) event database is a general term for storing all kinds of intermediate and final data. It can be a complex database or a simple text file.

The above is all the contents of the article "what can intrusion detection system be divided into according to the source of detection data?" Thank you for your reading! Hope to share the content to help you, more related knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.