Intrusion detection methods in modern IDS systems

References

Chat With PDF

Cite

Share

Abstract

Currently, the problem of protection of information and communication systems and resources of cyberspace is acute. The rapid development of the information sphere also leads to the modernization and complexity of methods of attacking cyberspace objects. The statistics of successful attacks on computer systems of various organizations, including government agencies, are growing every year. From this we can conclude that even the most reliable protection systems do not give a 100% guarantee of protection. One of the possible reasons for this state of affairs may be the use of standard security mechanisms and methods by most security systems. Such mechanisms include access delimitation based on the rights of the access subject, encryption and identification and authentication. Traditional methods cannot protect against their own users who have criminal intent. In addition, this approach does not solve the problem of clear division of existing system entities for authorized use of globalized resources, the ability to select passwords using specialized software, and the problem of limiting access to information system resources, which can result in reduced performance and complexity passing transactions between components of this system. Thus, there is a need to use mechanisms that would not reject the advantages of traditional ones, but also complement them. Namely, that these mechanisms detect attempts at unauthorized, unauthorized access, provide information about these attempts, and also be able to respond. One of the key factors in the use of such protection systems is their ability to prevent attacks by attackers who have been authenticated and authorized in accordance with all procedures and access rules and have obtained the necessary rights to certain actions. Of course, it is impossible to predict a complete set of event scenarios in a system with an authorized user who has malicious intent, but it is necessary to make a detailed description of possible "mali-cious" scenarios, or go back and describe the so-called "normal" scenarios. The description of normal scenarios will make it possible to detect dangerous activity, because this activity will deviate from the so-called "normal" scenario of behavior in the system, even by an authorized user. Thus, exploring the possibility of using mechanisms that are aimed at detecting anomalies in the system, or to search for abuses can help implement effective solutions for intrusion detection and prevention systems