From the course: Cisco Network Security: Intrusion Detection and Prevention
Join today to access over 22,600 courses taught by industry experts or purchase this course individually.
IDS signature files - Cisco Routers Tutorial
From the course: Cisco Network Security: Intrusion Detection and Prevention
IDS signature files
- [Instructor] Pattern based or signature detection is the simplest triggering method as it monitors the network for a matching pattern using predefined signatures. A signature has three distinctive attributes, type, trigger, and action. The signature database is the heart of the system as it holds the signatures of known attacks and malicious behavior. A signature is either atomic or single-packet or composite, or multi-packets. When there is a match, the device executes the corresponding action, alert, logging function, or sends an alarm to the management software. For the system to be most effective, the signature file must be updated on a regular basis. Cisco collects data on malware variants and new threats as they are discovered, and updates and creates signatures on a regular basis. The signatures are then distributed to clients according to the threat level. If the threat is severe, Cisco will publish the signature files within hours of identifying the threat. Less aggressive…
Download courses and learn on the go
Watch courses on your mobile device without an internet connection. Download courses using your iOS or Android LinkedIn Learning app.