DETECT AND MITIGATE INTRUSION DURING CYBER ATTACKS

Cybersecurity

An intrusion detection system (IDS) is a type of security technology that tracks hostile or unauthorized activity on computer networks and systems. An IDS's main objective is to spot potential security gaps, record information about them, and notify security administrators so they may take the necessary action. There are two main types of IDS: network based IDS (NIDS) and host-based IDS (HIDS). While HIDS keeps an eye on each individual host system for odd activity, NIDS watches network traffic for suspicious behavior and spots potential dangers. IDS can be further categorized as signature based or anomaly based, depending on the detection technique used. Anomaly-based IDS employ statistical analysis to find changes from expected network behavior, while signature-based IDS compare known harmful activity patterns with observed network traffic. The employment of IDS, which is frequently used in conjunction with other security measures like firewalls and antivirus software, is essential for defending computer networks from different kinds of cyberattacks. Malt Rail is a harmful traffic detection system that makes use of static-trails generated from various antivirus reports and user-defined custom lists, as well as publicly available (black)lists containing malicious and/or generally suspicious trails. A trail can be anything from a domain name (for example, zvpprsensinaix.com for Banjari malware), URL (for example, hXXp://109.162.38.120/harsh02.exe for known malicious executable), IP address (e.g 185.130.5.231 for known attacker) Additionally, it makes use of (optional) sophisticated heuristic methods that can aid in the discovery of new risks (like malware).

This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.