From the course: Cisco Network Security: Intrusion Detection and Prevention
Join today to access over 22,600 courses taught by industry experts or purchase this course individually.
Signature-based IDS - Cisco Routers Tutorial
From the course: Cisco Network Security: Intrusion Detection and Prevention
Signature-based IDS
- [Instructor] Cisco intrusion detection system security appliances primarily use signature-based technology to monitor and compare traffic as it passes through the device to detect patterns in network traffic. A signature-based intrusion detection system must contain a current database of known attack signatures that is tuned to detect intrusions and malicious activity. A signature is either atomic or composite. An atomic signature is a single packet, activity, or event. A composite signature is also called a stateful signature, because it's a sequence of events involving multiple packets dispersed across multiple hosts during a period. Because it is stateful inspection, the device must keep a state table. A signature engine has a parser and an inspector. The parser reads the text-based descriptions for all signatures. The inspector looks for malicious activity in the network traffic stream. There are several signature engines or categories that each has its own set of signatures…
Download courses and learn on the go
Watch courses on your mobile device without an internet connection. Download courses using your iOS or Android LinkedIn Learning app.