Intrusion Detection System (IDS) and Intrusion Prevention System (IPS)

[@fargooseisaac4154]

Good training material!!

[@GauravKumar-fj7tp]

4:29 Zero day is not date of creation but the day of predefined attack.

[@ashcharj19]

Intrusion Detection System: It is sn monitoring system which detected suspicious activity from usual behavior and generates alerts when they are detected. Type of IDS: Host-Based IDS and Network based IDS. Detection Method of IDS Deployment: Signature Detection ,Anomaly Detection and Hybrid Detection. IDS vs IPS: The switch on which configure a mirror code on this switch or span port then we r gonna feed that data to IDS and it will analyze all those traffic traffic that is passing through it. It can detected and create alert but can't prevent it. IPS: IPS is in series. It could be in monitoring mode or protection mode. If some malware will come in system it will block the data. But in the beginning the we r supposed to keep IPS as monitoring mode so that it can detected once it becomes mature enough then we can alter into protection mode.