Principles of Computer Security-Key Terms 1 of 2

Analysis engine – Examines the collected network traffic and compares it to known patterns of suspicious or malicious activity stored in the signature database. The analysis engine is the “brains” of the IDS.

Anomaly detection model – An IDS model where the IDS must know what “normal” behavior on the host or network being protected really is. Once the “normal” behavior baseline is established, the IDS can then go to work identifying deviations from the norm, which are further scrutinized to determine whether or not that activity is malicious.

Banner grabbing – A technique used to gather information from a service that publicizes information via a banner.

Content-based signature – Signatures that are designed to examine the content of such things as network packets or log entries. Content-based signatures are typically easy to build and look for simple things, such as a certain string of characters or a certain flag set in a TCP packet.

Context-based signature – Signatures that are designed to match large patterns of activity and examine how certain types of activity fit into the other activities going on around them. Context signatures generally address the question: How does this event compare to other events that have already happened or might happen in the near future? Context-based signatures are more difficult to analyze and take more resources to match, as the IDS must be able to “remember” past events to match certain context signatures.

Digital sandbox – The isolation of a program and its supporting elements from common operating system functions.

False negative – Term used when a system makes an error and misses reporting the existence of an item that should have been detected.

False positive – Term used when a security system makes an error and incorrectly reports the existence of a searched-for object. Examples include an intrusion detection system that misidentifies benign traffic as hostile, an antivirus program that reports the existence of a virus in software that actually is not infected, or a biometric system that allows access to a system to an unauthorized individual.

Honeynet – A network version of a honeypot, or a set of honeypots networked together.

Honeypot – A computer system or portion of a network that has been set up to attract potential intruders, in the hope that they will leave the other systems alone. Since there are no legitimate users of this system, any attempt to access it is an indication of unauthorized activity and provides an easy mechanism to spot attacks.

Host-based IDS (HIDS) – A system that looks for computer intrusions by monitoring activity on one or more individual PCs or servers.

Intrusion detection system (IDS) – A system to identify suspicious, malicious, or undesirable activity that indicates a breach in computer security.