CertiGuide to Security+  9  Chapter 3:  Infrastructure Security (Domain 3.0; 20%)       9  3.4  Intrusion Detection

3.4.1.2  Passive Detection 1 2 3.4.2.1  Active Detection

In contrast to network based IDS, host based IDS focus on monitoring for unauthorized activities occurring on hosts themselves, including both incoming/outgoing network traffic involving the host running the IDS and other events on the host which do not involve the network. Host based IDS have been around for a long time (since the 1980’s, says ISS³⁴⁰). They range from simple accounting record auditing packages (which may or may not run in real time), to more advanced detection systems that not only check system, security and event logs, but also periodically verify system file checksums to ensure that critical configuration files and executables have not changed, and/or monitor certain ports for connection activity.

To secure your network using host based IDS technology, you would have to install a copy of the host based IDS on each system you want to monitor. Unlike NIDS, a single installation can only monitor a single machine – generally the one on which it has been installed.

3.4.1.2  Passive Detection 1 2 3.4.2.1  Active Detection