Whis is better behavior based & signature based ?

[Guest]

Archived from groups: comp.security.firewalls (More info?)

Our company try to buy a good security solutions.

Especialy IPS( Intrusion Prevention Systems).


But I'm wondering that What is signature based & What is behavior based ?


IPS is really penacea++to all kinds of attacks ?

Nowadays "zero-day attack" is more important ..

I understand the zero-day attack situation but, What kind of choice more
smarter if you are comparing signature based

& behavior based IPS.. And I don't know what is signature & what is behavior
?



Could Anybody explain about this concepts ?
And Could Anybody who had a experience about IPS tell me the right choice ?




-------------- ÀÎÅÍ³Ý Ä«¸®½º¸¶ KORNET -------------

 

[Guest]

Archived from groups: comp.security.firewalls (More info?)

"castlerock" <castlerock@hanmir.com> wrote in message
news:c91tb3$1rn$1@news1.kornet.net...
> Our company try to buy a good security solutions.
>
> Especialy IPS( Intrusion Prevention Systems).
>
>
> But I'm wondering that What is signature based & What is behavior based ?
>
>
> IPS is really penacea++to all kinds of attacks ?
>
> Nowadays "zero-day attack" is more important ..
>
> I understand the zero-day attack situation but, What kind of choice more
> smarter if you are comparing signature based
>
> & behavior based IPS.. And I don't know what is signature & what is
behavior
> ?
>
>
>
> Could Anybody explain about this concepts ?
> And Could Anybody who had a experience about IPS tell me the right choice
?
>

This may help to expline the IDS as oppsed to IPS.

http://www.insightbb.com/external/search.asp?q=what+is+behavior+IPS&url=http%3A%2F%2Fwww.google.com%2Fsearch&btnG.x=55&btnG.y=3

The IPS is using Protocol Analysis I think.

http://www.securityfocus.com/infocus/1663

Some solutions use the Signature and Protocol Analysis methods using the OSI
and TCP/IP network models.

http://www.firewall-software.com/firewall_faqs/firewall_network_models.html

I think that ISS and its Real Secure and BlackIce products fall into the IPS
solution category where the IDS is coupled and linked to the firewall
component and the IDS instructs the FW component to close a port when the
Signature or Protocol Analysis engine detect attack behavior (anomalies) or
signatures in the traffic.

I could be wrong.

Duane