Lily,
The main difference in my opinion is that IPS are inline and can therefore
block more effectively and IDS aren't in line and monitor traffic on a
segment or switch. Are you wondering about the difference between IPS/IDS
and Attack Mitigation Systems?
Regards
-andy cuff
The Talisker Network Security Portal
http://securitywizardry.com
Computer Network Defence Ltd
-----Original Message-----
From: Lily [mailto:xiaoche111@hotmail.com]
Sent: 13 November 2004 14:53
To: focus-ids@securityfocus.com
Subject: need your help about IPS and IDS,thanks
hi,all
I have some questions to ask which must be simple to you I think.
1.IPS must build normal model while IDS can use the abnormal model(misuse
detection)?If it is what's the difference between the IDS's anomaly
detection and IPS?
2.Has someone formally use the data mining technology in the IPS?
3.Besides the DoS and buffer overflow etc,has any other way be used in IPS
just like the users behaviour analysis?
4.Why someone said IPS can not log the trace of the attacks while IDS can
do?I think IPS can do it easily.Maybe because IPS is in-line and log the
trace needing many time?
So depressed with the IDS/IPS and my thesis is flying in the sky:(
Thank you in advance.
Lily
---
Incoming mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.797 / Virus Database: 541 - Release Date: 15/11/2004
---
Outgoing mail is certified Virus Free.
Checked by AVG anti-virus system (http://www.grisoft.com).
Version: 6.0.797 / Virus Database: 541 - Release Date: 15/11/2004
--------------------------------------------------------------------------
Test Your IDS
Is your IDS deployed correctly?
Find out quickly and easily by testing it with real-world attacks from
CORE IMPACT.
Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708
to learn more.
--------------------------------------------------------------------------
