CyD Software Labs



CyD Software Labs > CyD IDS

CyD IDS (Intrusion Detection System)

Compatible with: Win9x/ME/NT/2000/XP/2003

A good administrator must do everything to nip in the bud any attack attempts on his or her system. What is the first thing hackers do to break in to a system? They collect information about the system. Hackers try to learn as much as possible about the system they want to break in to, and administrators must do everything to give as little information as possible about their system or, even better, throw hackers off the track with some false information.

The simplest and initial information gathering technique is port scanning. To determine who tried to scan ports on your machine, when, and from where, you have to detect any nonstandard port events. Doing this manually is difficult, and a good specialized program is called for.

Automated port scanning detection programs are a rather good attack detection tool but, unfortunately, not in all cases. For example, popular servers are scanned often. I believe that such servers as www.yahoo.com or www.microsoft.com are scanned thousands if not millions of times a day. It is useless to pay attention to each of these countless scans. The most important thing is that automatic attack detection consumes computing resources, and sometimes a quite substantial amount. If every scanning attempt is logged, hackers can devise attack-imitating packets. Then all the server will do is handling these supposed attacks. The effect will be a classical DoS attack, because the server will no longer process client requests. To avoid DoS attack you must use Firewall together with a IDS (intrusion detection/defense system).

However, detecting scanning attempts on a company or home network server is a certain way to prevent a break-in.

One of the simplest and most effective scanning detection utilities is CyD IDS. The utility monitors ports unused by the system, and when it detects attempts to access them it gathers as much information as possible about the IP address from which the scanning is conducted and saves it in a log file.

I recommend installing CyD IDS on no more than 10 ports, because too many ports may cause the hackers to become suspicious. Moreover, with CyD IDS installed on more than 10 ports, repeated scanning can divert system resources to CyD IDS, resulting in a successful DoS attack.

  1. 1. Run CyD IDS.
  2. 2. Select menu item Port | Add port to add port
  3. 3. A Add port dialog will be displayed where you can enter port number
  4. 4. Select menu item Port | Start monitoring to start port activity monitoring