Exam 8: Intrusion Detection

The IDS component responsible for collecting data is the user interface.

_________ involves the collection of data relating to the behavior of legitimate users over a period of time.

Snort can perform intrusion prevention but not intrusion detection.

A ________ model is used to establish transition probabilities among various states.

_________ are cooperative ventures that collect information about system vulnerabilities and disseminate it to systems mangers.

A _________ monitors the characteristics of a single host and the events occurring within that host for suspicious activity.

The _______ is the ID component that analyzes the data collected by the sensor for signs of unauthorized or undesired activity or for events that might be of interest to the security administrator.

A _________ is a security event that constitutes a security incident in which an intruder gains access to a system without having authorization to do so.

________ detection techniques detect intrusion by observing events in the system and applying a set of rules that lead to a decision regarding whether a given pattern of activity is or is not suspicious.

A distributed IDS consists of three main components: host agent module,central manager module,and ___________ module.

Network-based intrusion detection makes use of signature detection and anomaly detection.

The three classes of intruders are masquerader,clandestine user and _________.

__________ involves an attempt to define a set of rules or attack patterns that can be used to decide if a given behavior is that of an intruder.

Running a packet sniffer on a workstation to capture usernames and passwords is an example of intrusion.

A(n)________ is inserted into a network segment so that the traffic that it is monitoring must pass through the sensor.

The ________ is responsible for determining if an intrusion has occurred.

The _________ is the predefined formally documented statement that defines what activities are allowed to take place on an organization's network or on particular hosts to support the organization's requirements.

An intruder can also be referred to as a hacker or cracker.

_________ anomaly detection focuses on characterizing the past behavior of individual users or related groups of users and then detecting significant deviations.

A ________ is a legitimate user who accesses data,programs,or resources for which such access is not authorized,or who is authorized for such access but misuses his or her privileges.