Principles of Computer Security-Key Terms 1 of 2

What is the function of the analysis engine in an Intrusion Detection System (IDS)?

It examines collected network traffic and compares it to known patterns of suspicious or malicious activity.

What is an anomaly detection model in an IDS?

It identifies deviations from established 'normal' behavior on the network or host.

What is the purpose of banner grabbing?

To gather information from a service that publicizes data via a banner.

What are content-based signatures designed to do?

Examine the content of network packets or log entries, typically searching for specific strings or flags.

How do context-based signatures differ from content-based signatures?

They match large patterns of activity and assess how activities fit into surrounding events.

What is a digital sandbox?

An isolated environment for a program and its supporting elements away from common OS functions.

What does the term false negative mean?

When a system fails to report the presence of an item that should have been detected.

What constitutes a false positive?

When a security system incorrectly reports the existence of a searched-for object.

What is a honeynet?

A network setup of multiple honeypots designed to attract potential intruders.

What is a honeypot in network security?

A system set up to attract intruders, indicating unauthorized access attempts.

What does a host-based IDS (HIDS) monitor?

It monitors activity on individual PCs or servers for computer intrusions.

What is the primary purpose of an intrusion detection system (IDS)?

To identify suspicious, malicious, or undesirable activity indicating a breach in computer security.