IDs Techniques

Question 1

what is intrusion detection

Answer 1

A security service that monitors and analyzes system events for the purpose of finding, and providing real-time or near realtime warning of, attempts to access system resources in an unauthorized manner

Question 2

3 logical components of an intrusion detection system

Answer 2

1. sensors: collect data
2. analyzers: determine if intrusion has occurred
3. user interface: view output or control system behavior

Question 3

the base rate fallacy in IDS

Answer 3

must detect a substantial amount of intrusions while keeping false alarms moderate

Question 4

false positive

Answer 4

an authorized user flagged as an intruder
yes but it should have been no

Question 5

false negative

Answer 5

an intruder identified as an authorized user
no but it should have been yes

Question 6

depict the error matrix and where the curve of FP and FN would look like

Answer 6

• x axis: accuracy of alerts
• y axis: frequency of alerts
  for false positives:
• when accuracy of alert is low, the frequency of alerts is high
• it is a downward curve, meaning when accuracy is high then frequency of alert is low
  for false negatives:
• when accuracy of alert is low, so is the frequency of alerts
• when accuracy of alert is specific, frequency is higher but the curve does not go upwards (opposite to FP)