The Evolution of Intrusion Detection Systems

1
The Evolution of Intrusion Detection Systems
2
IDS Components

• Network Intrusion Detection (NID)
• Switched networks
• Encrypted networks
• High-speed networks
• Host-based Intrusion Detection (HID)
• Hybrid Intrusion Detection
• Network-Node Intrusion Detection (NNID)

3
A Brief History of IDS
along with the Haystack team, Heberlein
introduced the first idea of hybrid intrusion
detection.
the first commercial vendor of IDS tools, with
its Stalker line of host-based products.
Air Force's Cryptologic Support Center developed
the Automated Security Measurement System to
monitor network traffic on the US Air Force's
network.
ASIM made considerable progress in overcoming
scalability and portability issues.
UC Davis Lawrence Livermore Lab produced an IDS
that analyzed audit data by comparing it with
defined patterns.
Distributed Intrusion Detection System (DIDS)
augmented the existing solution by tracking
client machines as well as the servers it
originally monitored.
UC Davis's Todd Heberlein develop NSM, the first
network intrusion detection system
4
The players in IDS market (I)

• Cisco

Network-Based Catalyst 6000 IDS 4230 IDS 4210
Host-Based (Entercept tech) Standard
Edition Enterprise Edition
Entercept tech Standard Edition Enterprise Edition
Air Force Cryptologic Support Center ASIM
Wheel Group NetRanger
5
The players in IDS market (II)

• Internet Security Systems (ISS)

In 1997
In 1999
Network-Based RealSecure
Host-Based RealSecure
BlackICE Sentry
Network ICE BlackICE Sentry (GigaBit)
6
The players in IDS market (III)

• Symantec

Symantec
Network-Based NetProwler
Host-Based Intruder Alert
7
The players in IDS market (IV)

• Enterasys

Enterasys/Cabetron
Network-Based Dragon
Host-Based Squire
8
Network-based SecureNet Pro
Host-Based Centrax
Network-Based Centrax (NNID tech.)
Kane
NetworkICE
Centrax Entrax
MimeStar SecureNet Pro
ODS
Network Associates
Host-based CMDS
Host-based Kane
Trusted Information Systems
SAIC
Haystack Labs Stalker
UCAL Davis Lawrence Livermore labs
9
Conclusion

• Government funding and corporate interest helped
  Anderson, Heberlein, and Denning spawned the
  evolution of IDS.
• Intrusion detection has indeed come a long way,
  becoming a necessary means of monitoring,
  detecting, and responding to security threats.