Intrusion Detection Systems, Essay Example

Intrusion detection systems are considered to be one of the effective mechanisms for detecting threats and alerting to the concerned personnel in a timely manner. As wireless networks are gaining popularity due to its dependence on wireless communication and data transfer, there is a requirement of safeguarding the network from unauthorized access and cybercrimes (Framework for intrusion detection in IEEE 802.11 wireless mesh networks.2010).

In order to monitor and analyze wireless intrusion detection system for detection, examination and reporting of associated threats and risks, investigators must understand the installation process, functionality and operations of a WIDS. There are many certified tools available that are incorporated in wireless forensic investigations for detecting rogue access points. Some of the tools are ‘Network stumbler’ and ‘mini stumbler’.  These tools provides information related to signal to noise ratio, MAC address, SSID, Channel details and incorporation of a GPS for detecting the location       of any relevant access point discovery (EC-Council, n.d ). Moreover, there is also a requirement of understanding the decryption process for examining frames for unknown patterns of activities that transmit on the wireless network. However, forensic investigators utilize various WIDS types according to the requirements. These various WIDS types include Overlay, combined AP/WIDS, and combined AP/WIDS/Access Controller (Trost, 2010). Overlay WIDS persistently monitors and analyze the network traffic and generate alerts whenever there is an anomaly detected. The next type is a combined AP/WIDS approach, where it works as an access point to decrypt data along with the access of overall wireless contents that are required. Moreover, the last type that is AP/WIDS/Access Controller is comparatively recommended as the best of them all. AP/WIDS/Access Controller provides a broad scope i.e. access point monitoring and management, authorization based on identity, reports on encryption sessions created and supports intrusion detection functionality as well. Therefore, the scope of this type provides a framework that facilitates the investigators to analyze, identify and trace paths of an intruder coming from the wireless network.

References

Framework for intrusion detection in IEEE 802.11 wireless mesh networks.(2010). International Arab Journal of Information Technology (IAJIT), 7(4), 435-440.

Trost, R. (2010). Practical intrusion analysis: Prevention and detection for the twenty-first century. Boston: Addison-Wesley.

EC-Council. n.d. Computer forensics: Investigating wireless networks and devices (C(computer) hfi (hacking forensic investigator) Course Technology.