An Introduction to Network Intrusion Detection Systems

Network intrusion detection systems identify securityNetwork intrusion detection systems are now among
threats by detecting malicious activity such as scans,the most commonly used network based security
denial of service attacks and unauthorized accesstools.
through the examination of network traffic. They areIf a networked computer system is not equipped with
installed at strategic points on the network to monitora network intrusion detection system the network
traffic to and from all hosts on the network. Unlike aadministrators could be unaware of many attacks that
packet filter or firewall, where a packet filteringtake place and only become aware of a successful
decision is made on weather or not to allow traffic toattack when it symptoms occurs. An example of such
continue, network intrusion detection systems do notan attack could be where an unauthorized user
interfere with network traffic in any way. In simpleretrieves password files from a login server without
terms these systems could be described as a packetdamaging the host. The attack may only become
sniffer that also analyzes the captured packets.apparent when the intruder uses the password to gain
In 1997 ISS released RealSecure, the first commercialroot privileges, by which time the system security
network intrusion detection system which soon beganwould be severely compromised. In an environment
to gain in popularity. The following year Cisco took anequipped with a network intrusion detection system,
interest in this area of security by purchasing a securitywhen a successful or unsuccessful attack occurs, a
company called 'Wheel Group' in order to supply theirsecurity alert is generated and information is collected
customers with similar technologies. From that point, awhich could be invaluable as evidence if legal action is
host of companies took interest and became involvedto be taken or in preventing the attack from happening
in developing and evolving commercial systems.again.