được thực hiện bởi các chuyên gia được đào tạo đặc biệt duy trì một mức độ thành thạo. Một khi kết nối được trang bị kết thúc, một số hình thức kết nối và các khối được sử dụng. Sóng điện từ truyền thông không điều khiển được truyền để truyền tải các tín hiệu theo nghĩa đen kể từ khi khởi đầu của đài phát thanh. | SY0 - 201 each component you can gain some insight into how HIDSs operate. The analysis engine is perhaps the most important component of the IDS as it must decide what activity is okay and what activity is bad. The analysis engine is a sophisticated decision and pattern-matching mechanism it looks at the information provided by the traffic collector and tries to match it against known patterns of activity stored in the signature database. If the activity matches a known pattern the analysis engine can react usually by issuing an alert or alarm. An analysis engine may also be capable of remembering how the activity it is looking at right now compares to traffic it has already seen or may see in the near future so that it can match more complicated multistep malicious activity patterns. An analysis engine must also be capable of examining traffic patterns as quickly as possible as the longer it takes to match a malicious pattern the less time the IDS or human operator has to react to malicious traffic. Most IDS vendors build a decision tree into their analysis engines to expedite pattern matching. The signature database is a collection of predefined activity patterns that have already been identified and categorized patterns that typically indicate suspicious or malicious activity. When the analysis engine has a traffic pattern to examine it will compare that pattern to the appropriate signatures in the database. The signature database can contain anywhere from a few to a few thousand signatures depending on the vendor type of IDS space available on the system to store signatures and other factors. The user interface is the visible component of the IDS the part that humans interact with. The user interface varies widely depending on the product and vendor and could be anything from a detailed GUI to a simple command line. Regardless of the type and complexity the interface is provided to allow the user to interact with the system changing parameters receiving alarms
