Intrusion Detection Systems (IDS) in Computer Networks - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is an Intrusion Detection System (IDS)?

An IDS is a security tool that monitors network or system activities for malicious actions or policy violations and alerts administrators when such activities are detected.

beginner

Name the two main types of IDS.

The two main types are Network-based IDS (NIDS), which monitors network traffic, and Host-based IDS (HIDS), which monitors activities on individual computers.

intermediate

How does signature-based IDS detect threats?

Signature-based IDS detects threats by comparing network or system activity against a database of known attack patterns or signatures.

intermediate

What is the main difference between IDS and IPS?

IDS detects and alerts about suspicious activity but does not block it, while Intrusion Prevention Systems (IPS) can detect and actively block or prevent the malicious activity.

beginner

Why is it important to regularly update IDS signatures?

Regular updates ensure the IDS can recognize the latest threats and attack patterns, keeping the system protected against new vulnerabilities.

Which type of IDS monitors traffic on a network?

A Anomaly-based IDS

B Network-based IDS (NIDS)

C Signature-based IDS

D Host-based IDS (HIDS)

Network-based IDS (NIDS) monitors network traffic to detect suspicious activity.

What does a signature-based IDS rely on to detect attacks?

A Known attack patterns

B User behavior analysis

C Random sampling

D Encryption keys

Signature-based IDS uses known attack patterns or signatures to identify threats.

Which of the following is NOT a function of an IDS?

A Blocking malicious traffic automatically

B Monitoring system logs

C Alerting administrators about suspicious activity

D Detecting policy violations

IDS alerts but does not block traffic; blocking is done by IPS.

Host-based IDS (HIDS) primarily monitors:

A Firewall configurations

B Network traffic between devices

C Internet service provider logs

D Activities on a single computer or device

HIDS monitors activities such as file changes and system logs on individual devices.

Why should IDS signatures be updated regularly?

A To improve network speed

B To reduce power consumption

C To detect new types of attacks

D To increase storage space

Updating signatures helps IDS recognize new threats and stay effective.

Explain the difference between Network-based IDS and Host-based IDS.

Think about where the IDS is placed and what it watches.

Describe how signature-based IDS works and why it needs regular updates.

Consider how antivirus software works similarly.

Practice

1. What is the primary role of an Intrusion Detection System (IDS)?

easy

A. To replace firewalls in network security

B. To block all incoming network traffic automatically

C. To encrypt data transmitted over the network

D. To monitor network or system activity and alert on suspicious behavior

Solution

1. Step 1: Understand IDS function

   An IDS monitors network or system activity to detect suspicious or malicious behavior.

2. Step 2: Differentiate IDS from other tools

   Unlike firewalls or antivirus, IDS does not block attacks but alerts administrators.

3. Final Answer:

   To monitor network or system activity and alert on suspicious behavior -> Option D

4. Quick Check:

   IDS alerts suspicious activity [OK]

Hint: IDS alerts but does not block attacks [OK]

Common Mistakes:

• Confusing IDS with firewall functions
• Thinking IDS blocks attacks automatically
• Assuming IDS encrypts data

2. Which of the following is a correct description of a Network-based IDS (NIDS)?

easy

A. Blocks suspicious packets automatically

B. Monitors traffic on a specific host only

C. Monitors network traffic for multiple devices

D. Encrypts network data to prevent attacks

Solution

1. Step 1: Define Network-based IDS

   NIDS monitors network traffic across multiple devices by analyzing packets on the network.

2. Step 2: Compare with other options

   It does not monitor a single host only, nor does it block or encrypt traffic.

3. Final Answer:

   Monitors network traffic for multiple devices -> Option C

4. Quick Check:

   NIDS watches network traffic [OK]

Hint: NIDS watches network traffic, not just one device [OK]

Common Mistakes:

• Confusing NIDS with Host-based IDS
• Thinking NIDS blocks traffic
• Assuming NIDS encrypts data

3. Consider this scenario: An IDS detects unusual traffic patterns and sends an alert. What will happen next?

medium

A. The IDS automatically blocks the suspicious traffic

B. The IDS logs the event and alerts the administrator

C. The IDS shuts down the affected system

D. The IDS encrypts the suspicious traffic

Solution

1. Step 1: Understand IDS response to detection

   When IDS detects suspicious activity, it logs the event and alerts the administrator for review.

2. Step 2: Clarify IDS capabilities

   IDS does not block traffic, shut down systems, or encrypt data automatically.

3. Final Answer:

   The IDS logs the event and alerts the administrator -> Option B

4. Quick Check:

   IDS alerts and logs, no blocking [OK]

Hint: IDS alerts and logs, does not block [OK]

Common Mistakes:

• Assuming IDS blocks attacks automatically
• Thinking IDS controls system shutdown
• Confusing IDS with encryption tools

4. A system administrator configures an IDS but notices it is not alerting on suspicious activity. What is the most likely cause?

medium

A. The IDS signature database is outdated or missing

B. The IDS is blocking all traffic instead of alerting

C. The IDS is encrypting alerts, so they are hidden

D. The IDS is shutting down the network interface

Solution

1. Step 1: Identify common IDS issues

   If IDS does not alert, a common cause is an outdated or missing signature database that detects threats.

2. Step 2: Eliminate other causes

   IDS does not block traffic, encrypt alerts, or shut down interfaces by default.

3. Final Answer:

   The IDS signature database is outdated or missing -> Option A

4. Quick Check:

   Outdated signatures cause no alerts [OK]

Hint: Check IDS signature updates if no alerts appear [OK]

Common Mistakes:

• Thinking IDS blocks traffic by default
• Assuming IDS encrypts alerts
• Believing IDS disables network interfaces

5. An organization wants to detect unauthorized access attempts on individual computers and also monitor overall network traffic for attacks. Which IDS deployment strategy should they use?

hard

A. Deploy both Host-based IDS (HIDS) on computers and Network-based IDS (NIDS) on the network

B. Use only Network-based IDS (NIDS) to cover all devices

C. Use only Host-based IDS (HIDS) on critical servers

D. Replace IDS with a firewall for better protection

Solution

1. Step 1: Understand IDS types and coverage

   Host-based IDS (HIDS) monitors individual computers, while Network-based IDS (NIDS) monitors network traffic across devices.

2. Step 2: Match organization's needs

   To detect unauthorized access on computers and monitor network attacks, both HIDS and NIDS should be deployed together.

3. Final Answer:

   Deploy both Host-based IDS (HIDS) on computers and Network-based IDS (NIDS) on the network -> Option A

4. Quick Check:

   Use HIDS + NIDS for full coverage [OK]

Hint: Combine HIDS and NIDS for full protection [OK]

Common Mistakes:

• Using only one IDS type for all needs
• Replacing IDS with firewall only
• Ignoring host-level monitoring