Intrusion Detection Systems Flashcards
(20 cards)
An IDS is a cybersecurity tool that monitors network traffic and devices for _________ or _________ activity.
suspicious; malicious
_________-based IDS monitors network traffic for multiple hosts connected to a network segment.
Network
IDSs send alerts to security teams or a centralized security tool, such as a _________ system
security information and event management (SIEM)
_________-based detection methods use machine learning to identify anomalous behavior in network data and traffic.
Anomaly
IDSs can be integrated with _________, which can automatically stop detected threats.
intrusion prevention systems (IPSs)
What is an intrusion detection system (IDS)?
A cybersecurity tool that monitors network traffic and devices for suspicious or malicious activity.
What is a network-based IDS?
An IDS that monitors network traffic for multiple hosts connected to a network segment.
What is a signature-based detection method?
A detection method that monitors for specific patterns and sequences that match known attack signatures.
What is the role of a host-based IDS?
An IDS that operates on information collected from within a computer system.
What is the main challenge of using IDSs?
They can produce false positives and false negatives, making it challenging for organizations to manage.
_________-based IDS protects data, resources, and systems in cloud environments.
Cloud
Signature-based detection monitors for specific _________ and _________ that match known attack signatures
patterns; sequences
An IDS may generate _________ positives, which are alerts triggered by non-threatening activity.
false
IDSs can send alerts to a centralized security tool, such as a _________ system.
SIEM (security information and event management)
What is a cloud-based IDS?
An IDS that protects data, resources, and systems in cloud environments.
What is an anomaly-based detection method?
A detection method that uses machine learning to analyze network data and identify anomalous behavior.
What is the role of an IDS in cyber hygiene?
To monitor for threats as part of overall cybersecurity practices, though it cannot stop threats on its own.
What is a false negative in the context of an IDS?
When an IDS fails to detect a genuine threat, leading to no alert being issued.
What is an intrusion prevention system (IPS)?
A system that can automatically stop detected threats, often integrated with an IDS.
IDSs are a fundamental part of cyber hygiene, but they can’t _________ security threats on their own.
stop
