INTRUSION DETECTION SYSTEMS (Professional Elective - V) IV Year B.Tech. IT I - Sem JNTUH R-18

1. Compare and contrast the effectiveness of intrusion detection and intrusion prevention systems in mitigating cyber threats.

2. Analyze the limitations of traditional security solutions like firewalls and VPNs, necessitating the use of intrusion detection systems.

3. Differentiate between network-based and host-based intrusion detection systems based on their deployment and monitoring capabilities.

4. Discuss the challenges and benefits of implementing intrusion detection systems within modern organizational networks.

5. Explain the concept of vulnerability assessment and its role in identifying potential weaknesses exploited by attackers.

Unit - II: Understanding Threats and Attackers

1. Classify different types of network layer attacks, including port scans, denial-of-service attacks, and network penetration techniques.

2. Analyze the vulnerabilities exploited by application layer attacks like software exploits and code injection, outlining mitigation strategies.

3. Describe the various motivations and capabilities of different attacker categories, from individual hackers to sophisticated hacking groups.

4. Discuss the emerging threat of automated attacks through the use of drones, worms, and viruses, and propose defense mechanisms.

5. Evaluate the importance of understanding human factors in intrusion detection, addressing social engineering scams and identity theft attempts.

Unit - III: Signature-Based Detection and IDS Evaluation

1. Explain the fundamental concepts of a general intrusion detection system model and its key components.

2. Analyze the principles of signature-based intrusion detection systems, such as Snort, and their effectiveness in recognizing known threats.

3. Demonstrate your understanding of Snort rules by writing examples to detect specific types of network traffic anomalies.

4. Critically evaluate the strengths and weaknesses of signature-based detection, highlighting challenges like zero-day vulnerabilities.

5. Discuss various cost-sensitive approaches to IDS deployment and management, considering resource constraints and organizational needs.

Unit - IV: Anomaly Detection and Malware Analysis

1. Compare and contrast anomaly-based detection systems with signature-based methods, explaining their advantages for identifying unknown attacks.

2. Analyze different network behavior-based anomaly detectors, such as rate-based methods, and their effectiveness in detecting abnormal traffic patterns.

3. Discuss the principles of host-based anomaly detectors and their role in monitoring system behavior for suspicious activities.

4. Explain the role of software vulnerability assessment in intrusion detection and how it helps identify potential attack vectors.

5. Conduct an autopsy of a known worm or botnet, illustrating its functionalities and analyzing detection methodologies for such threats.

Unit - V: Advanced Technologies and Future Trends

1. Explain the importance of attack tree analysis and alert correlation in effectively handling intrusion detection alerts.

2. Discuss the challenges and potential of using document vectors and email/IM security tools for intrusion detection purposes.

3. Analyze the evolution of intrusion detection from signatures to thumbprints and zero-day detection methods.

4. Evaluate the challenges and potential solutions for addressing insider threats, including masquerade, impersonation, and deception techniques.

5. Discuss emerging trends in collaborative security and their potential impact on future intrusion detection systems.