Editing Intrusion detection system (section)

== Intrusion prevention ==

Some systems may attempt to stop an intrusion attempt but this is neither required nor expected of a monitoring system. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, and reporting attempts.  In addition, organizations use IDPS for other purposes, such as identifying problems with security policies, documenting existing threats and deterring individuals from violating security policies. IDPS have become a necessary addition to the security infrastructure of nearly every organization.<ref name="nist80094">{{cite journal |url=http://csrc.ncsl.nist.gov/publications/nistpubs/800-94/SP800-94.pdf |title=Guide to Intrusion Detection and Prevention Systems (IDPS) |first1=Karen |last1=Scarfone |first2=Peter |last2=Mell |journal=Computer Security Resource Center |issue=800–94 |access-date=1 January 2010 |date=February 2007 |archive-url=https://web.archive.org/web/20100601171625/http://csrc.ncsl.nist.gov/publications/nistpubs/800-94/SP800-94.pdf |archive-date=1 June 2010 |url-status=dead }}</ref>

IDPS typically record information related to observed events, notify security administrators of important observed events and produce reports. Many IDPS can also respond to a detected threat by attempting to prevent it from succeeding. They use several response techniques, which involve the IDPS stopping the attack itself, changing the security environment (e.g. reconfiguring a firewall) or changing the attack's content.<ref name="nist80094" />

'''Intrusion prevention systems''' ('''IPS'''), also known as '''intrusion detection and prevention systems''' ('''IDPS'''), are [[network security]] appliances that monitor network or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information about this activity, report it and attempt to block or stop it.{{r|GIDPS}}.

Intrusion prevention systems are considered extensions of intrusion detection systems because they both monitor network traffic and/or system activities for malicious activity. The main differences are, unlike intrusion detection systems, intrusion prevention systems are placed in-line and are able to actively prevent or block intrusions that are detected.{{r|Newman2009|page1=273|WhitmanMattord2009|page2=289}} IPS can take such actions as sending an alarm, dropping detected malicious packets, resetting a connection or blocking traffic from the offending IP address.{{r|Boyles2010}} An IPS also can correct {{nobr|[[cyclic redundancy check]] (CRC)}} errors, defragment packet streams, mitigate TCP sequencing issues, and clean up unwanted [[Transport layer|transport]] and [[network layer]] options.{{r|Newman2009|page1=278|TiptonKrause2007}}

=== Classification ===
Intrusion prevention systems can be classified into four different types:{{r|GIDPS|Vacca2010}}

# '''Network-based intrusion prevention system (NIPS)''':  monitors the entire network for suspicious traffic by analyzing protocol activity.
# '''Wireless intrusion prevention system (WIPS)''': monitor a wireless network for suspicious traffic by analyzing wireless networking protocols.
# '''Network behavior analysis (NBA)''': examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware and policy violations.
# '''Host-based intrusion prevention system (HIPS)''': an installed software package which monitors a single host for suspicious activity by analyzing events occurring within that host.

=== Detection methods ===
The majority of intrusion prevention systems utilize one of three detection methods: signature-based, statistical anomaly-based, and stateful protocol analysis.{{r|WhitmanMattord2009|page1=301|KirdaJha2009}}

# '''Signature-based detection''': Signature-based IDS monitors packets in the Network and compares with pre-configured and pre-determined attack patterns known as signatures. While it is the simplest and most effective method, it fails to detect unknown attacks and variants of known attacks.<ref name="Liao 16–24">{{Cite journal |last=Liao |first=Hung-Jen |last2=Richard Lin |first2=Chun-Hung |last3=Lin |first3=Ying-Chih |last4=Tung |first4=Kuang-Yuan |date=2013-01-01 |title=Intrusion detection system: A comprehensive review |url=https://www.sciencedirect.com/science/article/pii/S1084804512001944 |journal=Journal of Network and Computer Applications |volume=36 |issue=1 |pages=16–24 |doi=10.1016/j.jnca.2012.09.004 |issn=1084-8045|url-access=subscription }}</ref>
# '''Statistical anomaly-based detection''': An IDS which is anomaly-based will monitor network traffic and compare it against an established baseline. The baseline will identify what is "normal" for that network – what sort of bandwidth is generally used and what protocols are used. It may however, raise a False Positive alarm for legitimate use of bandwidth if the baselines are not intelligently configured.<ref name="Whitman">{{cite book
 |last1 = nitin.
 |first2 = verma
 |last2 = Mattord
 |title = Principles of Information Security
 |pages = [https://archive.org/details/principlesofinfo0000whit/page/290 290–301]
 |publisher = Course Technology
 |year = 2008
 |isbn = 978-1-4239-0177-8
 |url = https://archive.org/details/principlesofinfo0000whit/page/290
 }}
</ref> Ensemble models that use Matthews correlation co-efficient to identify unauthorized network traffic have obtained 99.73% accuracy.<ref>{{cite book |last1=Nti |first1=Isaac Kofi |last2=Nyarko-Boateng |first2=Owusu |last3=Adekoya |first3=Adebayo Felix |last4=Arjun |first4=R |title=2021 22nd International Arab Conference on Information Technology (ACIT) |chapter=Network Intrusion Detection with StackNet: A phi coefficient Based Weak Learner Selection Approach |date=December 2021 |pages=1–11 |doi=10.1109/ACIT53391.2021.9677338 |isbn=978-1-6654-1995-6 |s2cid=246039483 }}</ref>
# '''Stateful protocol analysis detection''': This method identifies deviations of protocol states by comparing observed events with "pre-determined profiles of generally accepted definitions of benign activity".{{r|WhitmanMattord2009}} While it is capable of knowing and tracing the protocol states, it requires significant resources.<ref name="Liao 16–24"/>