JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD B.Tech IV INTRUSION DETECTION SYSTEMS Previous Question Paper (February/March - 2022 - R18)

A Network-based Intrusion Detection System (NIDS) monitors network traffic by analyzing packets traversing the network segments. It is typically placed at strategic points such as the gateway or between subnets to inspect traffic for suspicious patterns, such as port scanning or denial-of-service attacks. NIDS provides broad coverage of the network but may struggle with encrypted traffic and cannot see activity occurring solely within a host.

A Host-based Intrusion Detection System (HIDS) is installed on individual endpoints, such as servers or workstations. It monitors internal activities, including system call logs, file integrity, registry changes, and local application behavior. HIDS is highly effective at detecting malicious actions performed by users or processes already inside the host, including insider threats and attacks that bypass the network perimeter. However, HIDS requires individual management for every host and consumes local system resources.

The current threat landscape is characterized by increasing complexity, automation, and professionalization of cybercrime. Key aspects include:

• Advanced Persistent Threats (APTs): Sophisticated, long-term campaigns where attackers gain stealthy access to networks to exfiltrate sensitive data over extended periods.
• Ransomware and Extortion: The rise of Ransomware-as-a-Service (RaaS) has lowered the barrier for entry, allowing even non-technical criminals to launch devastating attacks that encrypt data and demand payment.
• Supply Chain Attacks: Attackers target software vendors or third-party service providers to compromise the downstream users of their products, effectively bypassing traditional perimeter defenses.
• Automated Exploitation: The use of bots and AI-driven tools allows attackers to scan for vulnerabilities and launch attacks at a scale and speed that manual human defense cannot match.
• Social Engineering: Phishing and spear-phishing remain the primary vectors for initial access, exploiting human psychology to bypass technical controls.