Intrusion Detection Systems (IDS) in Cybersecurity - Mini Project: Build & Apply

Intrusion Detection Systems (IDS)

📖 Scenario: You are working in a small company's IT department. Your manager wants you to help understand how the company can detect unauthorized access attempts to its network. You will learn about Intrusion Detection Systems (IDS) by creating a simple checklist and categorizing types of IDS.

🎯 Goal: Build a simple structured overview of Intrusion Detection Systems (IDS) including types, detection methods, and common uses.

📋 What You'll Learn

Create a dictionary with IDS types and their descriptions

Add a list of detection methods used by IDS

Create a dictionary mapping IDS types to example use cases

Add a summary string describing the importance of IDS

💡 Why This Matters

🌍 Real World

Understanding IDS helps IT professionals protect networks by detecting suspicious activities early.

💼 Career

Knowledge of IDS is essential for cybersecurity roles such as security analyst, network administrator, and incident responder.

1

Create IDS Types Dictionary

Create a dictionary called ids_types with these exact entries: 'Network-based IDS' with value 'Monitors network traffic for suspicious activity', and 'Host-based IDS' with value 'Monitors activities on a single computer or device'.

Cybersecurity

# Create the dictionary ids_types with the specified entries
# Your code here

Hint

Use curly braces {} to create a dictionary with the exact keys and values given.

2

Add Detection Methods List

Create a list called detection_methods containing these exact strings in order: 'Signature-based', 'Anomaly-based', and 'Hybrid'.

Cybersecurity

ids_types = {
    'Network-based IDS': 'Monitors network traffic for suspicious activity',
    'Host-based IDS': 'Monitors activities on a single computer or device'
}

# Create the list detection_methods with the specified entries
# Your code here

Hint

Use square brackets [] to create a list with the exact strings in the given order.

3

Map IDS Types to Use Cases

Create a dictionary called ids_use_cases with these exact entries: 'Network-based IDS' mapped to 'Protects entire network segments', and 'Host-based IDS' mapped to 'Protects individual devices'.

Cybersecurity

ids_types = {
    'Network-based IDS': 'Monitors network traffic for suspicious activity',
    'Host-based IDS': 'Monitors activities on a single computer or device'
}

detection_methods = ['Signature-based', 'Anomaly-based', 'Hybrid']

# Create the dictionary ids_use_cases with the specified entries
# Your code here

Hint

Create a dictionary with the exact keys and values as given, matching IDS types to their use cases.

4

Add IDS Importance Summary

Create a string variable called ids_summary with this exact text: 'Intrusion Detection Systems help organizations identify and respond to unauthorized access attempts quickly.'

Cybersecurity

ids_types = {
    'Network-based IDS': 'Monitors network traffic for suspicious activity',
    'Host-based IDS': 'Monitors activities on a single computer or device'
}

detection_methods = ['Signature-based', 'Anomaly-based', 'Hybrid']

ids_use_cases = {
    'Network-based IDS': 'Protects entire network segments',
    'Host-based IDS': 'Protects individual devices'
}

# Create the string ids_summary with the specified text
# Your code here

Hint

Assign the exact text to the variable ids_summary using quotes.

Practice

1. What is the primary purpose of an Intrusion Detection System (IDS)?

easy

A. To monitor network or system activities for suspicious behavior

B. To automatically block all incoming network traffic

C. To replace firewalls in network security

D. To encrypt data during transmission

Solution

1. Step 1: Understand IDS function

   An IDS is designed to watch network or system activities to detect suspicious or malicious behavior.

2. Step 2: Differentiate from other tools

   Unlike firewalls or encryption tools, IDS does not block or encrypt but alerts about possible threats.

3. Final Answer:

   To monitor network or system activities for suspicious behavior -> Option A

4. Quick Check:

   IDS monitors and alerts [OK]

Hint: IDS alerts suspicious activity but does not block it [OK]

Common Mistakes:

• Confusing IDS with firewall that blocks traffic
• Thinking IDS encrypts data
• Assuming IDS replaces other security tools

2. Which of the following is the correct description of a Network-based IDS (NIDS)?

easy

A. Monitors network traffic for suspicious patterns

B. Monitors individual host activities only

C. Encrypts network data to prevent attacks

D. Automatically blocks detected intrusions

Solution

1. Step 1: Identify NIDS role

   NIDS monitors network traffic to detect suspicious patterns or attacks across the network.

2. Step 2: Exclude incorrect options

   It does not monitor individual hosts only, encrypt data, or block intrusions automatically.

3. Final Answer:

   Monitors network traffic for suspicious patterns -> Option A

4. Quick Check:

   NIDS watches network traffic [OK]

Hint: NIDS watches network traffic, not just one computer [OK]

Common Mistakes:

• Mixing NIDS with Host-based IDS
• Thinking NIDS blocks attacks automatically
• Confusing monitoring with encryption

3. Consider this simplified Python-like pseudocode for an IDS alert system:

alerts = []
for packet in network_traffic:
    if packet.source_ip == '192.168.1.100' and packet.port == 22:
        alerts.append('Possible SSH attack')
print(alerts)

What will be the output if two packets match the condition?

medium

A. Error: packet is undefined

B. ['Possible SSH attack']

C. []

D. ['Possible SSH attack', 'Possible SSH attack']

Solution

1. Step 1: Analyze the loop and condition

   The code checks each packet; if source IP is '192.168.1.100' and port is 22, it adds a message to alerts.

2. Step 2: Consider two matching packets

   Since two packets meet the condition, the message is appended twice, resulting in two identical alerts.

3. Final Answer:

   ['Possible SSH attack', 'Possible SSH attack'] -> Option D

4. Quick Check:

   Two matches add two alerts [OK]

Hint: Each matching packet adds one alert to the list [OK]

Common Mistakes:

• Assuming only one alert regardless of matches
• Thinking the list remains empty
• Confusing variable scope causing error

4. A system administrator wrote this IDS rule snippet:

if packet.protocol = 'TCP':
    alert('TCP packet detected')

What is the error in this code?

medium

A. No error, code is correct

B. Using single equals sign (=) instead of double equals (==) for comparison

C. Incorrect protocol name 'TCP'

D. Missing parentheses in alert function

Solution

1. Step 1: Identify the comparison operator

   The code uses '=' which is an assignment operator, not a comparison operator.

2. Step 2: Correct operator for condition

   For checking equality, '==' must be used to compare values in conditions.

3. Final Answer:

   Using single equals sign (=) instead of double equals (==) for comparison -> Option B

4. Quick Check:

   Use '==' to compare values in conditions [OK]

Hint: Use '==' for comparison, '=' is assignment [OK]

Common Mistakes:

• Confusing assignment and comparison operators
• Ignoring syntax errors from wrong operator
• Assuming protocol name is wrong

5. You want to design an IDS that detects suspicious login attempts by checking if a user fails to login 3 times in a row within 5 minutes. Which approach best applies IDS concepts to solve this?

hard

A. Use a Network-based IDS to block all login attempts after 3 failures

B. Use encryption to hide login attempts from attackers

C. Use a Host-based IDS to monitor login logs and trigger alerts on 3 failed attempts within 5 minutes

D. Use a firewall to allow only 3 login attempts per user

Solution

1. Step 1: Identify IDS type for login monitoring

   Host-based IDS monitors activities on a single computer, such as login logs, suitable for detecting failed login attempts.

2. Step 2: Understand IDS role and limits

   IDS alerts on suspicious activity but does not block actions automatically; blocking is done by other tools.

3. Final Answer:

   Use a Host-based IDS to monitor login logs and trigger alerts on 3 failed attempts within 5 minutes -> Option C

4. Quick Check:

   Host IDS monitors logs and alerts [OK]

Hint: Host IDS watches logs and alerts, does not block [OK]

Common Mistakes:

• Confusing IDS with blocking tools like firewalls
• Thinking IDS encrypts or blocks automatically
• Using network IDS for host-specific login events