Which IDS is software-based, real-time network intrusion detection system?

Which IDS is software-based, real-time network intrusion detection system?

• A. Snort
• B. OSSEC
• C. Sguil
• D. General Indications of Intrusion

Answer: (A)

Software-based, real-time network intrusion detection systems inspect traffic as it moves across a network and raise alerts immediately. Snort fits this description perfectly: it is a widely used network IDS that runs as software on general-purpose platforms, analyzes packets in real time using a rule-based engine, and generates alerts and logs as events are observed. OSSEC is a host-based IDS, focusing on events on individual machines rather than on network traffic. Sguil is an alert management console that helps analysts view and correlate alerts from sensors like Snort, rather than being the detector itself. “General Indications of Intrusion” isn’t an IDS product. So Snort is the best match for a software-based, real-time network IDS.

Software-based, real-time network intrusion detection systems inspect traffic as it moves across a network and raise alerts immediately. Snort fits this description perfectly: it is a widely used network IDS that runs as software on general-purpose platforms, analyzes packets in real time using a rule-based engine, and generates alerts and logs as events are observed. OSSEC is a host-based IDS, focusing on events on individual machines rather than on network traffic. Sguil is an alert management console that helps analysts view and correlate alerts from sensors like Snort, rather than being the detector itself. “General Indications of Intrusion” isn’t an IDS product. So Snort is the best match for a software-based, real-time network IDS.