9. IDS and IPS to detect and react to intrusions

Intrusion Detection Systems (IDS) detect intrusions on a network by collecting and analyzing data provided by several network devices. Their aim is to detect any abnormal activity, such as probing activities (port scanning, fingerprinting ), system compromise attempts, log file audits and so on. They are based on two techniques that can be used in complementary ways: signatures of known attacks, which are based, among other things, on the search for patterns (sequence of bytes), verification of compliance with protocol standards, etc.; and the behavioral approach, which detects any deviation from a pre-established profile for a user, service or application, this profile being measured using metrics such as CPU (Central Processing Unit) load, volume of data transmitted, connection time to resources, etc. The disadvantage of the signature-based approach is that the signature database needs...