JAWAHARLAL NEHRU TECHNOLOGICAL UNIVERSITY HYDERABAD B.Tech IV INTRUSION DETECTION SYSTEMS Previous Question Paper (July/August - 2022 - R18)

The current state of threats against computer systems is characterized by high sophistication, automation, and a shift toward financial or political motivation. Modern threats are no longer limited to isolated viruses; they have evolved into complex, multi-stage cyberattacks. Key aspects include:

• Advanced Persistent Threats (APTs): Targeted, long-term campaigns where attackers gain unauthorized access and remain undetected to steal sensitive data.
• Automated Exploitation: The use of bots and AI-driven tools to scan for vulnerabilities and launch attacks at scale, reducing the time between vulnerability disclosure and exploitation.
• Ransomware and Extortion: A dominant threat where data is encrypted or exfiltrated to force victims into paying ransoms.
• Supply Chain Attacks: Compromising third-party software or hardware vendors to gain access to the primary target's infrastructure.
• Social Engineering: Highly personalized phishing and spear-phishing campaigns that exploit human psychology rather than just technical flaws.

Intrusion Detection Systems (IDS) are classified based on their placement and the scope of monitoring. Network-based IDS (NIDS) monitors traffic on a network segment. It is placed at strategic points, such as behind firewalls or at the edge of the network, to analyze packets passing through the network interface. NIDS is effective at detecting broad attacks like port scans or DoS attempts across multiple hosts, but it struggles with encrypted traffic and cannot see activity occurring locally on a host.

Host-based IDS (HIDS) is installed directly on individual endpoints (servers or workstations). It monitors internal activities, including system calls, file integrity, registry changes, and local log files. HIDS is highly effective at detecting unauthorized access, privilege escalation, and malicious activity that bypasses network defenses. However, HIDS is resource-intensive, requires individual management for every host, and provides no visibility into network-wide traffic patterns.