5. Conclusion

Intrusion detection tools have been around for a few years now, and their use is spreading throughout information systems and networks. They have left the military domain and are beginning to be integrated into the definition of commercial information system architectures. For the most part, these systems analyze traffic (network, requests) sent to an information system, and search their knowledge bases for elements identifying this traffic as dangerous. The natural evolution of these systems is to take into account generic descriptions of attack mechanisms, rather than the detection of specific attacks on known vulnerabilities. In a second phase, intrusion detection systems may appear on the market that use security policy concepts to detect actions that do not comply with security policy, even if the underlying attack is not explicitly identified.

Intrusion Prevention...