Host-based IDSs normally utilize information from which of the following sources

Although a business appears to make every effort to protect its assets, there is still no security guarantee. Hackers being fully aware of this uncertainty, tend to take complete advantage by tricking users or bypassing restrictions of the technology products in use, allowing them to acquire complete access. Such perils have given rise to the necessity of having a proactive approach towards cyber security to identify, prepare and respond to events.

One such preventive measure is Host-based intrusion detection systems (HIDS), deployed by organizations to recognize threats on the hosts within the network perimeter. In this write-up, we shall have a detailed look at the idea of the host-based intrusion detection system, its functioning, advantages, disadvantages and related elements to intrusion detection and prevention technology.

Feel free to watch this video containing a condensed version of the article.

But first, let’s get the basics right. 

What is HIDS?

HIDS stands for “host-based intrusion detection system”. It is an intrusion detection system (a software application) used to monitor and detect any suspicious activity in a host. It may include intrusions through external factors and inappropriate use of resources and data by internal factors. 

Host-based intrusion detection system (HIDS) definition is stated as “an intrusion detection system that has the capability to monitor and analyze the internal aspects of a computing system and any incoming/outgoing networking packets on its network interfaces.”.

Host-based technology is ‘passive’ in nature, which implies that it is purposed to detect suspicious activities, not prevent them. Therefore, a Host intrusion detection system is usually used in combination with intrusion prevention systems (IPS), which are ‘active’ in nature. For a business that wishes to accomplish more extensive security visibility, host-based intrusion detection systems are generally stationed on a server and network-based intrusion detection systems (NIDS), which aggregates and analyses the security events from various sources.

How does HIDS work?

Host-based intrusion detection systems (HIDS) use a sensor identified as ‘HIDS agents‘ installed within the monitorable assets for detecting threats. A host-based system employs an aggregate of signature-based and anomaly-based detection systems. The signatures one examines files in comparison with a database of signatures that are perceived to be malicious. Simultaneously, the anomaly-based detection system examines events with a baseline of standard system behaviour.

The functioning of host IDS is similar to the home security systems that most of us have seen, but they are much more advanced and involve high-tech operations. The Host IDS records the sceptical activities and reports them to the teams operating the security monitoring and response. File and integrity monitoring is a critical function that tracks ingress/egress activities and changes to files on the host, recording audit events that can be used to analyze and validate data integrity. File Integrity Monitoring (FIM) is a helpful part of complying with regulatory requirements such as PCI DSS compliance. PCI compliance requirements state that a business needs to monitor resource usage in the cardholder data environment (CDE). Even if it’s not payment card data, an organisation must protect PII data belonging to its customers and staff. 

If you are gathering and managing all the different recorded data from various applications individually, it may instantly become an overwhelming task draining your available set of resources. Additionally, it is a tremendous amount of data to maintain track of. That is where a host-based intrusion detection system proves highly useful!

The host-based intrusion detection system’s tools monitor the applicant’s record files and create a report of the activities and functions. It allows you to instantly find them for anomalies while there might be signs of intrusion. Apart from that, a compilation of the report files is also provided, letting you keep them organized such that they align with the directory structure of the report files server. It makes the process of searching and sorting files according to the applications, dates, and other metrics almost hassle-free. 

Apart from these, one of the fundamental functions of HIDS tools is an automated detection system that keeps us from the requirement of sorting the report files for suspicious behaviours after they are finished organizing and compiling. Besides, Host IDS adopt certain rules and policies, out of which some are available. We can still modify and update them to make them suitable for the organization’s requirements and preferences. It helps in searching the report files, flagging the ones with an activity event that the rules may have thought could indicate potential malicious behaviour. 

The host-based intrusion detection system (HIDS) can identify multiple attack vectors, including:

• Unapproved login and access efforts
• Escalation of privilege
• Adjustment of application binaries, information, and file configurations
• Installation of undesired applications and associations
• Rogue methods
• Crucial services that have been suspended to run

The accuracy of an IDS ties down to one of four outcomes against the observed event. It could be:

1. A false positive is an event outcome when IDS has identified an attack but is a false alarm. These are counted as overhead, often leading to wastage of time and resources.
2. A false negative is an event outcome when IDS actually missed alerts about the actual attack. It is the most serious state of all, adding a blind spot for security teams.
3. A true positive is an event outcome related to the successful identification of an attack.
4. A true negative is an event outcome when it is right to ignore acceptable behaviour.

What are the advantages of a host-based intrusion detection system (HIDS)?

1. A HIDS can detect a local event on the host system and identify security attacks and interventions that may elude a network-based IDS.
2. A HIDS operates on the host system, wherein the encrypted traffic would be decrypted and made available to processes and system files accessing the data.
3. Advanced Persistent Threats (APT) involve threat actors staying in a victim’s network for longer periods by evading detection mechanisms. An advantage of Host-based IDS is to help detect and prevent APTs.
4. A HIDS can detect inconsistencies and deviations about how an application and system program was practised by reviewing the record collected in audit log files. It enables the system to recognize some kinds of security attacks, including the Trojan Horse program.

What are the disadvantages of a host-based intrusion detection system?

1. HIDSs give rise to more management concerns as they are configured and operated on each monitored host. It implies that the system would demand more management efforts to install, configuration, and operate a HIDS. 
2. A HIDS isn’t optimized for detecting multi-host scanning; neither can it report a non-host network device’s scanning, such as a router or switch. If a complex correlation analysis is not presented, the HIDS will be unaware of the attacks that traverse multiple devices within the network. 
3. It is prone to susceptible to certain Denial of Service (DoS) attacks.
4. It uses a large amount of disk/storage space for retaining the host as audit records and functioning correctly. It may necessitate disk capacity to be supplemented to the system.
5. A HIDS can administer a performance burden on the host system, and in a few cases, it may lower the system’s performance below satisfactory levels. 

Top open-source Host IDS tools

Some of the HIDS examples are OSSEC, Quadrant, Splunk, snort and others. However, newer vendors have come up with cloud options and tools, allowing worry-free log files storage and security and faster access to data. Cloud-based HIDS are an option for companies with workloads spread around AWS, Azure and other clouds.

OSSEC: As per their statement “OSSEC+ provides additional capabilities to the basic OSSEC version such as the Machine Learning System for those that simply register. The cost is still free but OSSEC+ does more!”

Wazuh: Host IDS along with a number of features covering security analytics, cloud security and more. 

Tripwire: A free and open-source Host based IDS by Tripwire

For disclosure: the examples provided here are just for the sake of this article; we have no inclination or commercial relationship of any kind with any of these vendors.

Advanced persistent threat attack detection is usually due to added threat intelligence into host-based IDS systems known as ATP (Advanced Threat Protection). Sorry about the confusing acronyms; ATP (Advanced Threat Protection) and APT are the opposites working around the defensive and offensive sides of security. Cyber threat intelligence is the information around threats and attackers that are used to stop and prevent attacks. Threat intelligence relies on various sources pulling information from social media, human intelligence, open-source intel(OSINT), technical intelligence or deep/dark web information. See more around how digital attack surface assessment provides a point in time snapshot of their attack surface.

What is the difference between HIDS and NIDS?

HIDS vs NIDS is not another comparison to incline which one is better than the other. Both IDS are useful components that are often implemented together to add a layered approach to security management. Even though host-based intrusion detection systems are essential to ensure a reliable defence line to fight security attacks and malicious threats, they are not the sole means of guarding your assets (especially hosts). An added intrusion detection system, known as the Network-based intrusion detection systems, or NIDS, provides network-level protection targeting incoming and outgoing internet traffic. 

HIDS vs NIDS

Let’s understand the difference between the two.

HIDS monitors the traffic and keeps track of any suspicious actions on the particular host (an endpoint) installed. Unlike NIDS, HIDS are more informed of incoming security attacks due to system file and integrity monitoring functionality, keeping an eye on the system files and processes targeted by attacks.

On the contrary, NIDS monitors network traffic and events. Both HIDS and NIDS operate by surveying the log files and event information generated by the system. However, NIDS also analyses packet data as and when data travels through a network. Both the kinds of intrusion detection systems are diverse as NIDS operate majorly in real-time, tracing live data for tampering signs. At the same time, HIDS analysis logged records for proof of malicious events.

Anomaly-based vs signature-based

Both IDS can be classified into two sub-categories as per their detection methods. They are:

1. Anomaly-based Detection
2. Signature-based Detection

There is no straightforward mapping among NIDS and HIDS due to inherent differences in their functionalities and target scope (host and network).

A HIDS having a signature-based strategy operates in the same direction as most antivirus arrangements, while the network IDS equivalent works like a firewall. A NIDS makes the same reviews on network traffic coming in/out of the organization. Meaning it searches for a pattern in the data. However, firewall checks for keywords, packet varieties, and protocol activities on the incoming and outgoing network traffic. An antivirus application looks for a specific bit pattern or keyword in program files, while a HIDS performs the same for audit trails and log files.

An anomaly would look for surprising or sudden behaviour shown by a user or process. For instance, a user trying to log into the network from different parts of the world in one day. Another example is a server’s processor, abruptly starting to work hard at 3:00 AM. An anomaly-based HIDS will scan through the log files for reports of such extreme activities; an anomaly-based NIDS will attempt to detect these abnormalities as they take place.

A reliable security programme should include both-HIDS and NIDS, as they function together and show excellent results when they are complementing. Before buying Host-based IDS, it is essential to check the availability for different requirements such as compatibility with Windows and Linux OS (if in use within your environment), network and log management capabilities and integrations with other security assets in your company. Another factor would be functionalities and reporting structures available for various compliance requirements. Mostly these are related to PCI DSS, HIPAA (US federal statute), ISO standards, GPG13 (UK), GDPR, GLBA, FISMA, etc.

NIDS allows a speedier response time over possible security perils because real-time packet data monitoring may trigger signals if any suspicious activity takes place at the network level. HIDS will enable you to analyze past data for patterns of activities on the hosts, which is beneficial for savvy hackers who usually modify their method of intrusion to be further inconsistent and unpredictable so that the activity pattern is not easily traced.

Holding the record of activities enables you to monitor suspicious behaviours from a broader view, providing you with the capabilities to recognize patterns that may not trigger signals in the real-time detection system. Utilizing both kinds of intrusion detection systems together will help in keeping your information guarded against various angles.

HIDS vs HIPS

A simple, clear-cut way to remember the difference between HIPS and HIDS (also referred to as HIDS/HIPS) is:

• In HIPS, P stands for Prevention
• In HIDS, D stands for Detection

A Host Intrusion Prevention System (HIPS) is more recent than HIDS. The foremost distinction is that HIPS can help with Detection and protection against malicious threats. For instance, a HIPS deployment can recognize the host getting port-scanned and blocking all traffic from the host who issues the scan. A HIPS usually functions at the lower level with access to the kernel, and network status, record files, memories, and the practical execution of the procedure. Besides, a HIPS also guards against buffer overflow vulnerabilities. 

This discussion also leads towards HIPS vs antivirus. In this HIPS vs antivirus debate, lines get a little blurry due to modern AV solutions detecting and blocking advanced threats such as overflows similar to a HIPS. However, this is only a sub-set of HIPS offerings as file system checks, integrity monitoring, etc., are other HIPS features. With time, antivirus solutions have turned into anti-malware solutions as they detect and block malware threats. 

The beneficial aspect of intrusion prevention is that it prevents an attack without waiting for the security team’s instructions or response plan. A HIPS/HIDS is usually both- anomaly and signature-based.

What is the difference between an HIDS and a firewall?

A firewall is a device or software that filters traffic between a local (an office) and an external network (Internet). It doesn’t help detect and prevent any attacks at different layers except the basic traffic patterns. A HIDS helps to detect and report intrusions at the host level or network level (in the case of NIDS). 

Conclusion

In our fantasy world, the only people having access to your network and underlying hosts are the ones we know and trust completely. Providing access to a vendor and client that adds value to your enterprise will be commonplace. Sadly, the unfortunate reality is that malicious actors worldwide are continually attempting an intrusion in various ways utilizing different attack vectors such as insider threats, exploitation of device and software vulnerabilities on a server.

Utilizing Cyphere’s managed services is one way to minimize costs and maximize efficiency. Our team ensures we are validating the hids/hips controls and configuration against identifying multiple threats such as :

• Privilege escalation attempts
• Installation of new applications or changes to the existing ones
• Unauthorized login and access control violations
• File and data integrity changes
• Rogue processes

A business must guard its environment against such threats to detect and eradicate the possibilities of attempted intrusion. Risk can be either mitigated, transferred or accepted. Host IDS helps with alerts transmitted to security teams to analyze and work on the response and recovery phases.

Get in touch to discuss your security concerns around HIDS in network security, detection strategy or validation assessments. 

What are the three types of IDS sources available?

What is examples of host

What is the tool is used for the host

Which of the following applies to network based IDS?