Phát hiện xâm nhập là một công cụ cho các nhân viên an ninh sử dụng để bảo vệ tổ chức tấn công. Phát hiện xâm nhập là một khái niệm phản ứng mà cố gắng để xác định một hacker khi thâm nhập một là cố gắng. Lý tưởng nhất, như vậy sẽ chỉ có một hệ thống báo động khi một cuộc tấn công thành công được thực hiện. | CHAPTER 14 Intrusion Detection Copyright 2001 The McGraw-Hill Companies Inc. Click Here for Terms of Use. 261 262 Network Security A Beginner s Guide Intrusion detection is another tool for security staff to use to protect an organization from attack. Intrusion detection is a reactive concept that tries to identify a hacker when a penetration is attempted. Ideally such a system will only alarm when a successful attack is made. Intrusion detection can also assist in the proactive identification of active threats by providing indications and warnings that a threat is gathering information for an attack. In reality as we will see in the following pages this is not always the case. Before we discuss the details of intrusion detection let s define what it actually is. Intrusion detection systems IDS have existed for a long time. Some of the earliest forms included night watchmen and guard dogs. In this case the watchmen and guard dogs served two purposes they provided a means of identifying that something bad was happening and they provided a deterrent to the perpetrator. Most thieves were not interested in facing a dog so they were unlikely to attempt to rob a building with dogs. The same is true for a night watchman. Thieves did not want to be spotted by a watchman who might have a gun or who would call the police. Burglar and car alarms are also forms of IDS. If the alarm system detects an event that it is programmed to notice such as the breaking of a window or the opening of a door lights go on an alarm sounds or the police are called. The deterrent function is provided by a window sticker or a sign in the front yard of the house. Cars often have a red light visible on the dashboard to give an indication that an alarm is active. All of these examples share a single principal aim detect any attempt to penetrate the security perimeter of the item business building car and so on being protected. In the case of a building or car the security perimeter is easy to .
