Advances and challenges in standalone host-based intrusion detection systems

Abstract

Lately a significant research effort was given to the development of network-based, hybrid and collaborative intrusion detection systems. Standalone host-based intrusion detection systems (HIDSs) were out of the main focus of security researchers. However, the importance of standalone HIDSs is still considerable. They are a suitable alternative when we need to secure notebooks traversing between networks, computers connected to untrusted networks or mobile devices communicating through wireless networks. This survey presents recent advances in standalone HIDSs, along with current research trends. We discuss the detection of intrusions from a host network traffic analysis, process behavior monitoring and file integrity checking. A separate chapter is devoted to the protection of HIDS against tampering. © 2012 Springer-Verlag.