Components of an Intrusion Detection System

Intrusion detection systems can provide you with peace of mind.Ryouchin/Digital Vision/Getty Images

Intrusion detection systems are at the core of the computer and network security business. To the uninitiated, they bear a passing resemblance to firewalls, though there is an important difference: While firewalls seek to improve security by limiting network access between separate networks, an IDS aims to find intrusions and malicious activity within the system.There are two major classes of these systems: network-based (NIDS) and host-based (HIDS). As the names suggest, NIDS methods involve scanning network traffic, while HIDS methods involve scanning the machines connected to the network themselves.

Sensor/Agent

This is the component that actively monitors traffic and activity. The term sensor usually indicates network-based monitoring, whereas agent is more often used in description of host-based systems.

The management server is the device, either physical or software based, that the sensor or agent reports its findings to. Some management servers are configured to provide a more high-level view of activity analysis than the sensors themselves by using data gathered by the sensors to sniff out traffic that might not have been picked up as suspect. Further still, some smaller IDS deployments don't use a management server at all, though this is rare. Larger IDS deployments often use multiple management servers for a high level of overview.

A database server is the general vault for all information recorded by the sensors and management servers. This is basically the archive of the system where event logs reported and/or handled by sensors, agents or the management server are stored.

This is the end-user's connection to the system, where IT and Network Security professionals get their hands into things. Some consoles are designed strictly for administration and configuration purposes, such as tweaking sensors to look for a certain type of traffic, while others are solely for monitoring and analysis by a human.

All these components may be connected to each other through the networks of the company or organization that runs the IDS, or they may be connected to a server devoted to security software management. In these cases, each piece of the system also utilizes a management interface to connect to the management server, and is not given permissions to pass traffic from said interface to any other network interfaces it may be connected to. This effectively hides the IDS behind a layer of obscurity, making it more difficult for a would-be malicious user to disable, bypass or otherwise marginalize the effectiveness of the system.

The main drawbacks of such a setup are the inevitable increase in cost and maintenance hours that come with maintaining a separate network, and the mild hassle for administrators or users of having to interact with multiple PCs for monitoring and managing the organization's IDS.