1. Review question #2: False positives tend to make users insensitive to alarms, and thus reduce their reactivity to actual intrusion events. Also, false positive seems like an alert, but is in fact, routine activity. A false negative seems like normal activity and is in fact an alert-level action. From a security perspective, a false negative is least desirable because a false negative are a failure in the mission of the system.
2. Review question #8: A padded cell is identical in intent and presentation to a honey pot, but with a more protective system added so that it is not so easily to corrupted or compromised. In addition, it contain tempting interesting-looking data, a padded cell, also operates in a racing with an IDPS, which transfers attackers to a simulated environment where attackers can do no harm. In summary, a padded cell is a honey pot that has been protected so that that it cannot be easily broke or a hardened honey pot.
3. Review question #9: Footprinting is the organized research of the Internet addresses owned or controlled by a target organization. The attacker uses public
…show more content…
Exercises #3: There are many classification methods that can be used with IDPS’s systems. The main point of this system is to detect hostile actions. The first classification is based on the place where ID systems can be placed and the second one is based on analysis of the technique used. These ID systems can be classified into three main groups starting with Host Based Intrusion Detection System (HIPS), then Network Behavior Analysis (NBA), Network Based Intrusion Detection System (NIPS), and Wireless Intrusion Prevention System (WIPS). The WIPS it analysis the traffic of wireless network, NBA examines traffic to identify threats that generate unusual traffic flow, HIPS monitor single host for suspicious activity, NIPS it analyzes the traffic of entire network. Each of these methods can be easily used and are important because they can be used classify IDPS