HIDS: what it means

In short

An intrusion detection system (IDS) can watch network traffic or the individual machine. In the first case it is called a NIDS (network-based), in the second a HIDS (host-based). A HIDS sees what the network does not show: who logged in to the server, which system file changed, which service was added. An IDS alerts; if it also blocks, it is called an IPS (Intrusion Prevention System).

How it works

An agent on the host usually carries out several checks together:

• log analysis of the operating system and applications, with rules that recognise suspicious events (repeated failed logins, new accounts, services started);
• file integrity monitoring and, on Windows, monitoring of registry keys;
• configuration checks, compared against hardening rules;
• rootkit detection and detection of anomalies in processes.

Events are sent to a central console, often a SIEM, where they are correlated with those from other machines and generate alerts.

Why it matters

Many attacks are visible only on the host: an attacker using valid credentials generates entirely normal network traffic, but leaves traces in the access logs and in changes to the system. A HIDS is also a compliance tool: access logging, integrity checking and log retention are required by standards such as ISO/IEC 27001 and PCI DSS.

Compared with an EDR, a HIDS concentrates on logs, files and configurations and is geared towards detection; EDR records process behaviour in more detail and includes response actions. The two technologies partly overlap and often coexist.

Example

On the company web server the HIDS records three events in ten minutes: a new local user created, the same user added to the administrators group, and a change to a configuration file of the SSH service. No malicious program is involved, and there is nothing odd about the network traffic. Correlating the three events triggers a critical alert, and whoever receives it finds that a weak service password had been guessed the night before.

What follows is predictable: password replaced, user removed, configuration restored, and a rule that flags every new administrative account on the servers, so that next time the alert arrives at the first event.

Related terms

• File Integrity Monitoring
• SIEM
• EDR
• Indicators of compromise (IoC)