IPS and IDS systems per detection system
There are different ways of trying to distinguish anomalous or malicious behavior, so different IDS system developers have addressed the problem in different ways. Although the solutions that we can find in the market usually include several of these forms of work, they have traditionally been categorized as follows: Signature-based detection : This system attempts to locate a previously known chain of information in a communication. Thus, the system analyzes http traffic for request strings that induce a possible SQL Injection attack. The main advantage of this strategy is its high efficiency to detect attacks already known but, as a counterpart, it is practically useless to detect attacks not yet known by the system. Policy-based detection : This system requires a thorough definition of the type of communication (and not just ports and protocol) between servers or different networks. These are very effective systems that require detailed configuration. Detection based on anoma...