LANEYE NETWORK INTRUSION DETECTION AND PREVENTION SOFTWARE

resp Active response. Closes the connection down (for example, takedown connections).react Active response. Respond with a set of scripted behavior (for exam-ple, block certain Web sites).reference External attack reference IDs. sid Snort rule ID.rev Rule revision number.Howlett_CH07.fm Page 223 Thu[r]

tions are asked, it becomes clear that the answers are not black and white. Instead, theydepend upon other events and the state of the target system.TYPES OF INTRUSION DETECTION SYSTEMSThere are two primary types of IDS: host-based (H-IDS) and network-based[r]

1.5Organization..........................................................................................................................72 Background and Related Approaches ..........................................................................................82.1Network Intrusi[r]

The Problem of NIDS False Positives 199Common Causes of False PositivesNetwork Monitoring System Activity Many companies use a Network MonitoringSystem (NMS) such as HP OpenView or WhatsUp Gold to keep track of the systems ontheir networks. They generate a lot of polling and discovery[r]

Keep in mind that goals can be combined and that the actual goals for any IDS dependon the organization that is deploying it. This is by no means a comprehensive list. The IDScan allow an organization to detect when an attack starts and may allow for the collectionof evidence or the