NIDS Security Model

• Analyze live network traffic, attempt to detect malicious traffic

  • Raise an alert (common)
  • Reconfigure firewall in “real time” to block malicious traffic (not common)

• Log traffic or signatures for later analysis