Intrusion Detection Systems (IDS) in Computer Networks - Mini Project: Build & Apply

Intrusion Detection Systems (IDS) Basics

📖 Scenario: You are a network administrator setting up a simple overview of an Intrusion Detection System (IDS) to understand how it works in monitoring network traffic for suspicious activities.

🎯 Goal: Build a step-by-step conceptual model of an IDS using simple data structures and logic to represent monitored network events and detection rules.

📋 What You'll Learn

Create a data structure to hold network events with exact event types and sources

Add a configuration variable to specify a suspicious activity threshold

Implement logic to identify events that exceed the threshold

Complete the model by marking detected suspicious events clearly

💡 Why This Matters

🌍 Real World

Network administrators use IDS to monitor and detect unusual activities that may indicate security threats.

💼 Career

Understanding IDS basics helps cybersecurity professionals identify and respond to potential intrusions effectively.

1

Create the network events data structure

Create a dictionary called network_events with these exact entries: 'login_failure': 5, 'port_scan': 3, 'malware_alert': 1, 'data_exfiltration': 0

Computer Networks

# Create the dictionary network_events with the specified entries
# Your code here

Hint

Use a Python dictionary with event names as keys and their counts as values.

2

Set the suspicious activity threshold

Create a variable called suspicious_threshold and set it to 2 to represent the minimum number of events considered suspicious

Computer Networks

network_events = {'login_failure': 5, 'port_scan': 3, 'malware_alert': 1, 'data_exfiltration': 0}
# Create suspicious_threshold variable and set it to 2
# Your code here

Hint

This variable helps decide which events are suspicious based on their count.

3

Identify suspicious events

Create a list called suspicious_events that includes all event names from network_events where the event count is greater than or equal to suspicious_threshold using a for loop

Computer Networks

network_events = {'login_failure': 5, 'port_scan': 3, 'malware_alert': 1, 'data_exfiltration': 0}
suspicious_threshold = 2
# Create suspicious_events list with event names meeting or exceeding the threshold
# Your code here

Hint

Use a for loop to check each event's count and add the event name to the list if it meets the threshold.

4

Mark detected suspicious events

Create a dictionary called detected_alerts where keys are event names from network_events and values are True if the event is in suspicious_events, otherwise False, using dictionary comprehension

Computer Networks

network_events = {'login_failure': 5, 'port_scan': 3, 'malware_alert': 1, 'data_exfiltration': 0}
suspicious_threshold = 2
suspicious_events = []
for event, count in network_events.items():
    if count >= suspicious_threshold:
        suspicious_events.append(event)
# Create detected_alerts dictionary marking suspicious events as True
# Your code here

Hint

Use dictionary comprehension to create a new dictionary with True or False values based on suspicious_events membership.

Practice

1. What is the primary role of an Intrusion Detection System (IDS)?

easy

A. To replace firewalls in network security

B. To block all incoming network traffic automatically

C. To encrypt data transmitted over the network

D. To monitor network or system activity and alert on suspicious behavior

Solution

1. Step 1: Understand IDS function

   An IDS monitors network or system activity to detect suspicious or malicious behavior.

2. Step 2: Differentiate IDS from other tools

   Unlike firewalls or antivirus, IDS does not block attacks but alerts administrators.

3. Final Answer:

   To monitor network or system activity and alert on suspicious behavior -> Option D

4. Quick Check:

   IDS alerts suspicious activity [OK]

Hint: IDS alerts but does not block attacks [OK]

Common Mistakes:

• Confusing IDS with firewall functions
• Thinking IDS blocks attacks automatically
• Assuming IDS encrypts data

2. Which of the following is a correct description of a Network-based IDS (NIDS)?

easy

A. Blocks suspicious packets automatically

B. Monitors traffic on a specific host only

C. Monitors network traffic for multiple devices

D. Encrypts network data to prevent attacks

Solution

1. Step 1: Define Network-based IDS

   NIDS monitors network traffic across multiple devices by analyzing packets on the network.

2. Step 2: Compare with other options

   It does not monitor a single host only, nor does it block or encrypt traffic.

3. Final Answer:

   Monitors network traffic for multiple devices -> Option C

4. Quick Check:

   NIDS watches network traffic [OK]

Hint: NIDS watches network traffic, not just one device [OK]

Common Mistakes:

• Confusing NIDS with Host-based IDS
• Thinking NIDS blocks traffic
• Assuming NIDS encrypts data

3. Consider this scenario: An IDS detects unusual traffic patterns and sends an alert. What will happen next?

medium

A. The IDS automatically blocks the suspicious traffic

B. The IDS logs the event and alerts the administrator

C. The IDS shuts down the affected system

D. The IDS encrypts the suspicious traffic

Solution

1. Step 1: Understand IDS response to detection

   When IDS detects suspicious activity, it logs the event and alerts the administrator for review.

2. Step 2: Clarify IDS capabilities

   IDS does not block traffic, shut down systems, or encrypt data automatically.

3. Final Answer:

   The IDS logs the event and alerts the administrator -> Option B

4. Quick Check:

   IDS alerts and logs, no blocking [OK]

Hint: IDS alerts and logs, does not block [OK]

Common Mistakes:

• Assuming IDS blocks attacks automatically
• Thinking IDS controls system shutdown
• Confusing IDS with encryption tools

4. A system administrator configures an IDS but notices it is not alerting on suspicious activity. What is the most likely cause?

medium

A. The IDS signature database is outdated or missing

B. The IDS is blocking all traffic instead of alerting

C. The IDS is encrypting alerts, so they are hidden

D. The IDS is shutting down the network interface

Solution

1. Step 1: Identify common IDS issues

   If IDS does not alert, a common cause is an outdated or missing signature database that detects threats.

2. Step 2: Eliminate other causes

   IDS does not block traffic, encrypt alerts, or shut down interfaces by default.

3. Final Answer:

   The IDS signature database is outdated or missing -> Option A

4. Quick Check:

   Outdated signatures cause no alerts [OK]

Hint: Check IDS signature updates if no alerts appear [OK]

Common Mistakes:

• Thinking IDS blocks traffic by default
• Assuming IDS encrypts alerts
• Believing IDS disables network interfaces

5. An organization wants to detect unauthorized access attempts on individual computers and also monitor overall network traffic for attacks. Which IDS deployment strategy should they use?

hard

A. Deploy both Host-based IDS (HIDS) on computers and Network-based IDS (NIDS) on the network

B. Use only Network-based IDS (NIDS) to cover all devices

C. Use only Host-based IDS (HIDS) on critical servers

D. Replace IDS with a firewall for better protection

Solution

1. Step 1: Understand IDS types and coverage

   Host-based IDS (HIDS) monitors individual computers, while Network-based IDS (NIDS) monitors network traffic across devices.

2. Step 2: Match organization's needs

   To detect unauthorized access on computers and monitor network attacks, both HIDS and NIDS should be deployed together.

3. Final Answer:

   Deploy both Host-based IDS (HIDS) on computers and Network-based IDS (NIDS) on the network -> Option A

4. Quick Check:

   Use HIDS + NIDS for full coverage [OK]

Hint: Combine HIDS and NIDS for full protection [OK]

Common Mistakes:

• Using only one IDS type for all needs
• Replacing IDS with firewall only
• Ignoring host-level monitoring