IDS/IPS: Signatures vs Anomalies

Network IDS often sees a tap or a span port: a copy of frames, not always the live forwarding path. Host IDS watches logs, process starts, or file integrity on a machine. IPS is the cousin placed inline so a match can drop, reject, or reset. Those placements are literacy for a defender who owns the path: “do I only want a ticket, or do I want the box to refuse the packet.” They are not a map of where to stand so a school sensor cannot see you. If you do not own the sensor, you do not probe it to learn its blind spots. Module 1 already spent a lesson on that sentence.

Firewalls and IDS/IPS overlap in conversation and differ in job. A firewall enforces a port-and-state policy you wrote. An IDS/IPS asks whether the bytes inside an allowed conversation look like a known attack or an unusual shape. HTTPS on 443 can be allowed by the firewall and still worth alerting on if YOUR lab’s sensor is tuned to a pattern you chose — for traffic you are allowed to see. Encrypted payloads hide application bytes (Module 8 / Topic 8 TLS). That fact is why metadata, TLS errors, and host logs still matter. It is not a homework assignment to strip someone else’s TLS so the IDS can “see better.”

sudo apt install nmap

brew install nmap

choco install nmap  # or download https://nmap.org/download.html

cat >> "$NOTES" << 'EOF'
ids: watch and alert
ips: can interrupt matching traffic
refuse: nmap timing templates to hide from a SOC
EOF

A signature is a description of a known-bad shape: a byte string, a header combination, a named CVE pattern, a rule a human wrote. When traffic matches, the sensor alerts (IDS) or may block (IPS). Signatures are fast to explain and easy to version. They miss what they were never told: new malware families (Module 7), slightly different encodings, or a bug with no public rule yet. That miss is why vendors ship updates and why defenders still patch (Module 5) instead of worshiping a green dashboard. Naming “signature coverage has gaps” is humility. Teaching you how to mutate a payload until a specific rule goes quiet is an evasion cookbook, and this course will not write it.

If you run a sensor on a VM you own, you may read YOUR rule list, disable a rule that fires on YOUR teaching HTTP in a way you documented, and write the owner and the date — the same treatment discipline as Module 5. You may not copy a public exploit signature and then practice “how little I can change it to slip past.” You may not aim crafted packets at a classmate’s Suricata so you can screenshot “evaded.” Their sensor is not your lab. Public rule docs (vendor explainers, RFCs, your own comments) are reading. Replay against infrastructure you do not own is unauthorized testing.

Anomaly detection learns or is given a picture of “normal” — typical ports, typical volumes, typical process trees on a host — and flags deviations. A new outbound port on a lab VM you own can be a leftover listener (Module 4) or a backup tool you installed. A login at 03:00 can be you in another timezone or a stolen session (Module 11 named tokens; it did not give you a hijack PoC). The alert is the start of a question, not a conviction. That is why this lesson’s subtitle is alerts are clues. You investigate on systems you are allowed to know. You do not “prove” an anomaly by attacking a neighbor until their IDS agrees.

Anomalies false-positive when normal was drawn too tight (a deploy day looks like a flood) and false-negative when attackers stay inside the learned envelope. Defenders widen windows, add allow-listed change tickets, and still keep the sensor on. Attack blogs that teach “low-and-slow so the baseline never trips” are the timing-to-hide category this module forbids. You will not get nmap timing templates as an invisibility drill. You will get the defender sentence: if detection is noisy, tune the rule and the baseline on YOUR box; do not disable the camera because the picture is inconvenient.

Noise is real. Signature packs fire on scanners, on YOUR own vulnerability checks if you pointed them at YOUR lab, on leftover HTTP from Module 8. The wrong move is Disable All so the dashboard is green. The right move is: name the rule, name the asset, decide suppress-with-justification, retune, or fix the underlying leftover service. Write an owner. Write a revisit date. That is Module 5’s patch/compensate/accept posture applied to detection. “The SOC said it was noisy so we powered off IPS” is a sentence that shows up in breach reports. This course will not grade you for a quiet screenshot you bought by going blind.

Host firewall logs, IDS alerts, and application logs tell different layers (Module 3 already split connect vs what session logs see). On a box you own, prefer more than one kind of record. A teaching takeaway from earlier modules still holds: completed-connection logs can miss knocks that packet sensors still see. Use that gap to instrument YOUR lab, not to hide from a campus IDS. If you cannot say “this sensor is mine or in written RoE,” you do not generate traffic to test it. Café Wi-Fi is not RoE. A classmate’s homelab you were not invited to is not RoE.

An IDS/IPS note is boring on purpose. Date (UTC). Legal line: original Cyberlium teaching mapped to the CEH v13 IDS/firewall/honeypot domain — not official EC-Council training, not a cert, not exam dumps. IDS vs IPS in your words. Signature vs anomaly in your words. Alerts are clues. Tuning beats turn-it-off, with a one-line example on a sensor YOU would own. Ethics: no IDS evasion steps, no nmap decoys/fragments/timing to hide, no firewall punch, no attacking someone else’s honeypot. Path: $HOME/cyberlium-lab/ids-ips-notes.txt, chmod 600. Notes that list how to sneak past school.edu fail even if you never ran the command. World-readable 777 fails.

A useful feeling: “I cannot learn IDS without seeing a miss.” Seeing a miss on a sensor you own, after you wrote a rule that is supposed to fire on YOUR loopback demo, is a later professional skill with RoE. This lesson does not assign that drill, because the failure mode is immediately “let me try the café.” Definitions plus a refuse line are a complete Lesson 2. Do not paste evasion checklists as “research.” Do not add a decoy IP column.

On a computer you own, create cyberlium-lab if needed. Fill the template in YOUR words. Run the checker; it only reads YOUR file. chmod 600. Do not add a campus sensor because the file felt short.

cat >> "$NOTES" << 'EOF'
anomaly: unusual vs a baseline I own
not_automatically_evil: investigate, do not trophy
EOF

You now treat IDS as a camera and IPS as an inline cousin — signatures for known shapes, anomalies for unusual, alerts as clues, tuning instead of blindness. Evasion checklists, decoys, fragments, and timing-to-hide drills are out of this course. Notes are locked in cyberlium-lab. This is original Cyberlium teaching mapped to the CEH v13 IDS/firewall/honeypot domain — not official EC-Council training, not a cert, not exam dumps. Next — Honeypots as Tripwires — names decoy systems defenders deploy. You will not attack someone else’s honey.