Question

One form of IDS starts operation by generating an alert for every action. Over time, the administrator adjusts the setting of the IDS so that common activities do not generate alarms. What are the advantages and disadvantages of both designs for an IDS

Answer 1

Answer:

The term IDS refers to a system that listens to network traffic to detect abnormal or suspicious activities, and thus reduce the risk of intrusion.

Explanation:

Its advantages are

•They are connected in network segments, so with a single IDS you can detect attacks on all computers connected to that segment

•They are independent of the mobile platform by the different teams in the network.

•These are attacks to detect attacks detected in the detection of IP attacks or denial of service attacks that can block the server.

-They can behave as if they were invisible to attackers.

Its disadvantages are

•They are ineffective in systems with encrypted traffic.

•Its operation becomes difficult in network environments detected in high-speed computers, since they usually reach Gbps speeds, preventing the IDS from analyzing all packets on time.

•If there is momentary network congestion, the IDS could start losing packets.

•Because they operate in heterogeneous environments (Windows, Linux, etc.) they may not be able to define the relevance of an attack on each platform.