Guide to Intrusion Detection and Prevention Systems (IDPS)

By Karen Scarfone, Peter Mell. 2007

1,549 citations recorded by the source corpus.

Intrusion detection and prevention systems (IDPS) are focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators. In addition, organizations use IDPSs for other purposes, such as identifying problems with security policies, documenting existing threats, and deterring individuals from violating security policies. This publication describes the characteristics of IDPS technologies and provides recommendations for designing, implementing, configuring, securing, monitoring, and maintaining them. The types of IDPS technologies are differentiated primarily by the types of events that they monitor and the ways in which they are deployed. This publication discusses the following four types of IDPS technologies: network-based, wireless, network behavior analysis (NBA), and host-based.

Subfields: Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/8121219993d2781a1fd792617fada89d3c9fc292

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

Citations in the corpus

An Implementation of Intrusion Detection System Using Genetic Algorithm (2012, background): “An intrusion detection system is a device or software application that monitors network and/or system activities for malicious activities or policy violations and produces reports [4].”
An empirical comparison of botnet detection methods (2014, background): “The Cooperative Adaptive Mechanism for NEtwork Protection (CAMNEP) (Rehak et al., 2009) is a Network Behavior Analysis system (Scarfone and Mell, 2007) that consists of various state-of-the-art anomaly detection methods.”
Detecting and Preventing Cyber Insider Threats: A Survey (2018, background): “A highly cited guide regarding intrusion detection and prevention systems [132] defines an IDS as software that automates the intrusion detection process and an intrusion prevention system (IPS) is software that fulfils all functionalities of an IDS but also attempts to stop possible incidents.”
A Survey of Machine Learning Techniques Applied to Software Defined Networking (SDN): Research Issues and Challenges (2019, background): “(IDS) is a device or software application and its objective is to monitor the events in a network system and identify possible attacks [194].”
An intrusion detection and prevention system in cloud computing: A systematic review (2013, background): “IPSs are differentiated from IDSs by one characteristic; IPS can respond to a detected threat by attempting to prevent it from succeeding (Scarfone and Mell, 2007).”
When Intrusion Detection Meets Blockchain Technology: A Review (2018, background): “INTRUSION DETECTION Intrusion detection describes the process of monitoring network or system events for any sign of possible incidents [17].”
A hybrid intrusion detection system design for computer network security (2009, background): “These are network traffic data, system level test data and system status files [2,3].”
A survey of intrusion detection in Internet of Things (2017, methodology): “Thereby, this method usually has high false positive rates (Mitchell and Chen, 2014; Debar, 2002; Scarfone and Mell, 2007).”
Anomaly detection in wireless sensor networks: A survey (2011, background): “Intrusion detection is defined as the process of monitoring the events occurring in a computer system or network and analyzing them for any signs of possible incidents, which are violations or imminent threats of violation of computer policies, acceptable use policies, or standard practices (Scarfon”
A Review of Intrusion Detection Systems Using Machine and Deep Learning in Internet of Things: Challenges, Solutions and Future Directions (2020, background): “One drawback of this technique is the difficulty in building the normal behavior baseline profile, which gives rise to increased false positive rates [20,103,104].”
Passban IDS: An Intelligent Anomaly-Based Intrusion Detection System for IoT Edge Devices (2020, background): “An IDS continuously monitors incoming data streams generated by diverse sources, and analyzes it to detect possible signs of cyber threats [10].”
Cyber-physical systems security: Limitations, issues and future trends (2020, neutral): “However, such a detection method suffers from a high false positive rate [343], [348], [349].”
Intrusion Detection: A Survey (2008, methodology): “, a client system providing network services for other systems) [8].”