1. What is a Process Model in IDS?

• Definition: A structured workflow that an IDS follows to collect, analyze, and respond to threats.
• Objective: To detect attacks efficiently and reduce false alarms.
• Importance: Enables clear, repeatable steps for accurate and timely intrusion response.

2. Key Phases in IDS Process

1. Data Collection

   • Collects logs, network traffic, user activity.

2. Data Preprocessing

   • Filters and normalizes data.

3. Feature Extraction

   • Identifies relevant patterns or behaviors.

4. Detection/Analysis

   • Uses detection techniques (signature, anomaly, hybrid).

5. Alert Generation

   • Issues warnings for detected threats.

6. Response/Action

   • Blocks, alerts, or quarantines based on threat type.

3. Process Models

A. Signature-Based Detection

• Flow: Data Collection → Feature Extraction → Signature Matching → Alert → Response
• Strength: Fast and reliable for known threats.
• Weakness: Cannot detect new/unknown threats.

B. Anomaly-Based Detection

• Flow: Data Collection → Preprocessing → Baseline Creation → Anomaly Detection → Alert → Response
• Strength: Detects zero-day and novel threats.
• Weakness: High false positives during training.

C. Hybrid Detection

• Flow: Collect both host and network data → Extract features → Run signature & anomaly detection → Combine results → Alert → Response
• Strength: Balanced accuracy and coverage.
• Weakness: Complex and resource-intensive.

4. Visual Flow (General)

Data Collection → Feature Extraction → Detection → Alert → Response

5. Process Model Selection Criteria

1. Network Environment: Size and complexity.
2. Detection Needs: Known vs. unknown threats.
3. False Positive Tolerance
4. Resource Constraints
5. Cost vs. Benefit

6. Benefits of IDS Process Models

• Efficiency: Streamlined and optimized threat detection.
• Accuracy: Reduces false alarms.
• Responsiveness: Quicker and clearer reaction to threats.

7. Challenges

• Evasion Tactics: Encrypted or obfuscated attacks.
• High Computational Load: Especially for anomaly and hybrid models.
• Large Data Volume: Can cause delays or oversight.
• Integration Issues: With firewalls, SIEMs, IPS, etc.

8. Advantages & Limitations of Each Model

9. Data Collection in IDS

• Sources: Network traffic, system logs, user activity.
• Types:
  • Event logs (firewalls, systems)
  • Packets, flow data
  • Behavior-based data

10. Best Practices

1. Regular Updates: Signatures and baselines.
2. Use Hybrid Models: For complete coverage.
3. Threshold Tuning: Reduces false alarms.
4. Integration: With firewalls, SIEM, IPS for better security.