Security in Computing 5th Edition by Shari Lawrence Pfleeger, Charles P Pfleeger, Jonathan Margulies

Exercise 51

One form of IDS starts operation by generating an alert for every action. Over time, the administrator adjusts the setting of the IDS so that common, benign activities do not generate alarms. What are the advantages and disadvantages of this design for an IDS?

Step 1 of 2

Design of IDS

The main advantages of this design of the IDS are:

1. Analyze the ongoing traffic activity, the various transactions and the behavior of the anomalies.

2. The various potentials required to detect the previous types of the attack.

3. List the differences between the ongoing activities and the various baseline behaviors.

4. The real goal of the administrator is to watch the intruder and to watch that what all resources are accessed and what all attacks are tried.

5. Record all the activities of the traffic from the given sources for the further analysis.