Intrusion Detection and Prevention System (IDPS) Technology- Network Behavior Analysis System (NBAS)
Nitin Tiwari, Solanki Rajdeep Singh, Pandya Gajaraj Singh · 2012
Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of possible incidents, which are violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected possible incidents. Intrusion detection and prevention systems (IDPS) are primarily focused on identifying possible incidents, logging information about them, attempting to stop them, and reporting them to security administrators. In addition, organizations use IDPSs for other purposes, such as identifying problems with security policies, documenting existing threats, and deterring individuals from violating security policies. IDPSs have become a necessary addition to the security infrastructure of nearly every organization. In this paper we discuss the one technology of IDPS named network behavior analysis system. A network behavior analysis system (NBAS) is basically an IDPS (intrusion detection and prevention system) technology which examines network traffic to identify threats that generate unusual traffic flows, such as distributed denial of service (DDoS) attacks, certain forms of malware, and policy violations, In this paper we provides a detailed discussion of NBA technologies. First, it covers the major components of the NBA technologies and explains the architectures typically used for deploying the components. It also examines the security capabilities of the technologies in depth, including the methodologies they use to identify suspicious activity. The rest of the part discusses the management capabilities of the technologies, including recommendations for implementation and operation.