IDS mailing list archives
RE: need your help about IPS and IDS,thanks
From: "Andy Cuff" <lists () securitywizardry com>
Date: Wed, 17 Nov 2004 06:39:14 -0000
Lily, The main difference in my opinion is that IPS are inline and can therefore block more effectively and IDS aren't in line and monitor traffic on a segment or switch. Are you wondering about the difference between IPS/IDS and Attack Mitigation Systems? Regards -andy cuff The Talisker Network Security Portal http://securitywizardry.com Computer Network Defence Ltd -----Original Message----- From: Lily [mailto:xiaoche111 () hotmail com] Sent: 13 November 2004 14:53 To: focus-ids () securityfocus com Subject: need your help about IPS and IDS,thanks hi,all I have some questions to ask which must be simple to you I think. 1.IPS must build normal model while IDS can use the abnormal model(misuse detection)?If it is what's the difference between the IDS's anomaly detection and IPS? 2.Has someone formally use the data mining technology in the IPS? 3.Besides the DoS and buffer overflow etc,has any other way be used in IPS just like the users behaviour analysis? 4.Why someone said IPS can not log the trace of the attacks while IDS can do?I think IPS can do it easily.Maybe because IPS is in-line and log the trace needing many time? So depressed with the IDS/IPS and my thesis is flying in the sky:( Thank you in advance. Lily --- Incoming mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.797 / Virus Database: 541 - Release Date: 15/11/2004 --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.797 / Virus Database: 541 - Release Date: 15/11/2004 -------------------------------------------------------------------------- Test Your IDS Is your IDS deployed correctly? Find out quickly and easily by testing it with real-world attacks from CORE IMPACT. Go to http://www.securityfocus.com/sponsor/CoreSecurity_focus-ids_040708 to learn more. --------------------------------------------------------------------------
Current thread:
- need your help about IPS and IDS,thanks Lily (Nov 16)
- RE: need your help about IPS and IDS,thanks Andy Cuff (Nov 17)
- <Possible follow-ups>
- RE: need your help about IPS and IDS,thanks Eric McCarty (Nov 16)
- Re: need your help about IPS and IDS,thanks Lily (Nov 17)
- RE: need your help about IPS and IDS,thanks Andy Cuff (Nov 18)
- RE: need your help about IPS and IDS,thanks Chris Petersen (Nov 19)
- RE: need your help about IPS and IDS,thanks Stuart Staniford (Nov 22)
- RE: need your help about IPS and IDS,thanks Omar Herrera (Nov 23)
- Re: need your help about IPS and IDS,thanks Lily (Nov 17)
- Re: need your help about IPS and IDS,thanks Lily (Nov 17)
- Message not available
- need your help about IPS and IDS,thanks Zhuowei Li (Nov 19)