Intrusion Detection Systems (IDS) in Computer Networks - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is an Intrusion Detection System (IDS)?

An IDS is a security tool that monitors network or system activities for malicious actions or policy violations and alerts administrators when such activities are detected.

beginner

Name the two main types of IDS.

The two main types are Network-based IDS (NIDS), which monitors network traffic, and Host-based IDS (HIDS), which monitors activities on individual computers.

intermediate

How does signature-based IDS detect threats?

Signature-based IDS detects threats by comparing network or system activity against a database of known attack patterns or signatures.

intermediate

What is the main difference between IDS and IPS?

IDS detects and alerts about suspicious activity but does not block it, while Intrusion Prevention Systems (IPS) can detect and actively block or prevent the malicious activity.

beginner

Why is it important to regularly update IDS signatures?

Regular updates ensure the IDS can recognize the latest threats and attack patterns, keeping the system protected against new vulnerabilities.

Which type of IDS monitors traffic on a network?

A Anomaly-based IDS

B Network-based IDS (NIDS)

C Signature-based IDS

D Host-based IDS (HIDS)

Network-based IDS (NIDS) monitors network traffic to detect suspicious activity.

What does a signature-based IDS rely on to detect attacks?

A Known attack patterns

B User behavior analysis

C Random sampling

D Encryption keys

Signature-based IDS uses known attack patterns or signatures to identify threats.

Which of the following is NOT a function of an IDS?

A Blocking malicious traffic automatically

B Monitoring system logs

C Alerting administrators about suspicious activity

D Detecting policy violations

IDS alerts but does not block traffic; blocking is done by IPS.

Host-based IDS (HIDS) primarily monitors:

A Firewall configurations

B Network traffic between devices

C Internet service provider logs

D Activities on a single computer or device

HIDS monitors activities such as file changes and system logs on individual devices.

Why should IDS signatures be updated regularly?

A To improve network speed

B To reduce power consumption

C To detect new types of attacks

D To increase storage space

Updating signatures helps IDS recognize new threats and stay effective.

Explain the difference between Network-based IDS and Host-based IDS.

Think about where the IDS is placed and what it watches.

Describe how signature-based IDS works and why it needs regular updates.

Consider how antivirus software works similarly.