From the course: Cisco Network Security: Intrusion Detection and Prevention
Join today to access over 22,600 courses taught by industry experts or purchase this course individually.
Policy-based IDS - Cisco Routers Tutorial
From the course: Cisco Network Security: Intrusion Detection and Prevention
Policy-based IDS
- [Instructor] With Policy-Based Detection the administrator defines suspicious behavior and can create a customized policy to monitor for that activity. Policy-based intrusion detection is like pattern-based detection, but instead of trying to define a specific pattern, policy-based signatures can be used to analyze a specific type of packet. For example, having data in the flow label in an IPv6 header. How this can be used, we can use this example. The network administrator can set up a honeypot and gather evidence of an attacker trying to exploit a vulnerability that would be indicative of a possible zero day attack. The administrator then can create a customized intrusion rule. An intrusion rule is a set of criteria listing details and conditions the intrusion detection system must match. Much like a blueprint, the rule provides details of what to look for, and what action to take once the criteria is found. A standard rule will have two sections, the header and the options. The…
Download courses and learn on the go
Watch courses on your mobile device without an internet connection. Download courses using your iOS or Android LinkedIn Learning app.