Intrusion detection

● Intrusion detection is a second line of defense, when all the prevention technique is
compromised and an intrusion has potentially entered into the system.

● We will try to profile changes in live events inside our databases for irregular or intrusive
approaches made by someone.
● Two types of attack are usually there:
-> Inside attack by someone with privileges inside the system.
-> Outsider attack are usually people using sql injections and brute force techniques
compromising the operating system at times.

● Ealier techniques used for intrusion detection included Signature-based ID systems

detect intrusions by observing events and identifying patterns which match the
signatures of known attacks.