QUESTION 1 Wireless networks present different problems from wired networks for

Question

QUESTION 1

Wireless networks present different problems from wired networks for NIDS deployment because of the broadcast nature of transmission. Discuss the considerations that should come into play when deciding on locations for wireless NIDS sensors. (Hint: Refer to SCAR07)

QUESTION 2

A decentralized NIDS is operating with two nodes in the network monitoring anomalous inflows of traffic. In addition, a central node is present, to generate an alarm signal upon receiving input signals from the two distributed nodes. The signatures of traffic inflow into the two IDS nodes follow one of four patterns: P1, P2, P3, P4. The threat levels are classified by the central node based upon the observed traffic by the two NIDS at a given time and are given by the following table:

Threat Level

Signature

Low

1 P1 + 1 P2

Medium

1 P3 + 1 P4

High

2 P4

If, at a given time instance, at least one distributed node generates an alarm signal P3, what is the probability that the observed traffic in the network will be classified at threat level

Threat Level

Signature

Low

1 P1 + 1 P2

Medium

1 P3 + 1 P4

High

2 P4

Explanation / Answer

Question 1

Network-based IDS systems (NIDS) are often standalone hardware appliances that include network intrusion detection capabilities. It will usually consist of hardware sensors located at various points along the network or software that is installed to system computers connected to your network, which analyzes data packets entering and leaving the network.

Sensors can be deployed in one of two modes :

a)Inline. An inline sensor is deployed so that the network traffic it is monitoring must pass through it, much like the traffic flow associated with a firewall. One way to achieve an inline sensor is to combine NIDS sensor logic with another network device, such as a firewall or a LAN switch while others are simply IDPSs. The primary motivation for deploying IDPS sensors inline is to enable them to stop attacks by blocking network traffic . Inline sensors are typically placed where network firewalls and other network security devices would be placed

Related Questions

Navigate

• Browse (All)
• Browse Q
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.