Principles and Strategies of Network Intrusion Detection Systems

Summary

Network Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) serve as critical components of a modern cybersecurity posture. These systems utilize diverse detection methodologies—ranging from signature-based matching of known threats to anomaly-based identification of deviations from normal behavior—to secure organizational assets.

The effectiveness of these systems is inherently tied to the "tuning" process, which balances the need for high sensitivity against the operational burden of false positives. While traditional IDS focuses on monitoring and alerting, the evolution into Intrusion Prevention Systems (IPS) allows for real-time blocking of malicious traffic through techniques such as Deep Packet Inspection (DPI). Furthermore, the broader practice of Network Security Monitoring (NSM) emphasizes a holistic, event-driven approach that integrates alert, session, and full-content data to identify sophisticated "low-and-slow" attack vectors that real-time systems might overlook.

Core Detection Methodologies

The strategies employed to identify suspicious activity vary based on the criteria and patterns analyzed. The following table summarizes the primary detection methods:

IDS Classification and Error Management

The performance of an IDS is measured by its ability to correctly categorize traffic. There are four primary classification outcomes:

True Positives: Correct identification of undesirable/malicious traffic.
True Negatives: Correct identification of normal, benign traffic.
False Negatives: The failure to identify an attack, incorrectly labeling it as normal traffic. This risk is mitigated by using both network-based (NIDS) and host-based (HIDS) systems and deploying sensors at multiple strategic locations.
False Positives: The incorrect identification of normal traffic as an attack. These are addressed through system tuning.

The Tuning Process

Tuning optimizes the IDS to maximize detection while minimizing alerts for legitimate activity. Key aspects include:

Threshold Adjustment: Finding the balance between sensitivity and alert fatigue.
Rule Modification: Customizing signatures to fit the specific environment.
Allow Lists: Pre-authorizing known legitimate traffic patterns.
Baseline Adjustment: Fine-tuning "normal" profiles for anomaly-based systems.
Testing: Using simulated attacks to validate configuration effectiveness.

Tuning faces challenges including the complexity of network operations, the dynamic nature of the threat landscape, and the potential for the IDS to introduce latency or resource overhead.

Structural Varieties: NIDS vs. HIDS

Network-Based IDS (NIDS)

NIDS monitors traffic at strategic points across the network. Popular implementations include Snort, Suricata, Zeek, and Security Onion.

Host-Based IDS (HIDS)

HIDS is software installed on individual devices to monitor system files, calls, and resource utilization.

Advantages: Checks file integrity for unauthorized changes; identifies internal threats from authorized users; provides detailed logs for forensic investigations.
Disadvantages: Consumes local system resources; complex to manage at scale; often dependent on specific operating systems.
Common Tools: OSSEC, Wazuh, Tripwire, Samhain, AIDE, and Sysmon.

Active Detection and Intrusion Prevention (IPS)

Active systems are deployed when an IDS has been tuned to minimize false positives, allowing for real-time traffic blocking.

Blocking Mechanisms

NIDS Shunning: The system configures a firewall or router to block packets from an attacker’s IP. This is often a temporary measure but carries the risk of blocking legitimate users if the attacker spoofs an IP address.
TCP Resets: The system sends a spoofed TCP reset packet to the victim to terminate the session. This is difficult to execute as it requires guessing the correct TCP sequence number.

Intrusion Prevention Systems (IPS)

IPS technology represents an evolution of IDS, capable of preventing attacks in real-time. A core technique is Deep Packet Inspection (DPI), which examines both the packet header and the payload for granular control. IPS effectiveness is measured across three dimensions:

Accuracy: Ensuring malicious traffic is blocked while legitimate traffic is allowed (the most critical dimension).
Coverage: The breadth of attack vectors the system can protect against.
Timeliness: The speed at which the system offers protection against newly discovered threats.

Network Security Monitoring (NSM) and Response

NSM, also referred to as Network Detection & Response (NDR), involves the collection, analysis, and escalation of indicators to detect intrusions.

Data Collection Types

Packet-based (PCAP): Full packet capture for total visibility.
Flow-based (NetFlow): Analyzes IP traffic flow and volume (e.g., Cisco NetFlow, VPC flow logs).
Log-based: Output from specific traffic collections like email or TCP connection logs.

Analytical Approaches

NSM advocates for collecting as much data as possible and archiving it long-term to uncover "low-and-slow" attacks—stealthy techniques where attackers space out activities to avoid real-time detection.

Real-time Detection: Primarily uses signature matching. While fast, it often lacks historical context and can be resource-intensive.
Batch Analysis: Interpreting traffic well after it has traversed the network. This allows analysts to see the "big picture" and tie individual events into a cohesive representation of an intruder’s Tactics, Techniques, and Procedures (TTPs).
Event-driven Analysis: Focuses on individual events as indicators. Unlike simple products that just provide an alert, event-driven NSM utilizes alert, session, full content, and statistical data to validate compromises holistically.

Industry Standard Tooling

Organizations utilize a variety of specialized tools to perform NSM and IDS functions:

Packet Analyzers: Wireshark (microscopic level analysis), TCPdump (command-line analysis).
High-Performance Engines: Suricata (NIDS/IPS/NSM), Zeek (stateful traffic analysis and detailed logging).
Unified Platforms: Security Onion (integrates Zeek, Suricata, and Elasticsearch).
Specialized Monitors: Ntopng (visualization), Kismet (wireless 802.11 IDS), osquery (SQL-based OS exploration).
Flow & Vulnerability: NetFlow Traffic Analyzer, PRTG Network Monitor, Nessus (vulnerability scanning).

Glossary of Key Terms

Assessment elements

A. AI-supported, scenario-based project (TBD)

B. Discussion prompt

After reviewing this section, reflect on how Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) help protect networks.

In your comment, discuss:

One detection method (e.g., signature-based, anomaly-based, or behavior-based) and its strengths or limitations, and
Why tuning and monitoring are important for reducing false positives and improving system effectiveness.

Length: ~100–150 words.

1.5. Principles and Strategies of Network Intrusion Detection Systems