HIPS
Unlike HIDS solutions, which tell you only that a suspicious event took place, HIPS solutions attempt to stop the suspicious activity from happening in the first place. Like NIPS appliances, HIPS solutions can use signature-or behavioral-based approaches. For example, suppose an attacker wants to carry out a buffer overflow so that his malicious code can run in the memory space of the kernel. To prevent this type of activity, the HIPS solution will review the system call and compare it to either a list of signatures or a list of known good behaviors. If the HIPS solution identifies the call as malicious, it doesn't allow access. Vendors can use one or both approaches in their products. For example, McAfee's Entercept uses signature-and behavioral-based methods, whereas Cisco System's Cisco Security Agent (formerly known as Okena StormWatch technology) uses a purely behavioral-based approach.
Although the various HIPS solutions might use different approaches, most of them employ agents, which are centrally managed, on the systems needing protection. The agents examine system and API calls to identify when an attack is being attempted. The agent must understand the security context in which the process is running, the command requests being sent to the interface, and the resource that the process is attempting to access. When a call comes in, signature-based HIPS solutions check what is usually a long list of illegal call patterns that have been identified with certain types of attacks. If the incoming call contains one of the identified patterns, they don't allow access. Behavioral-based HIPS solutions usually have specific modules for individual system-service APIs. For example, there might be a module that reviews requests between processes and the file system, a module that reviews network stack requests, a module that monitors registry requests, and so on. There are also modules for commonly used services and applications, such as DNS, DHCP, and Microsoft SQL Server. . . .
Register
