HIPS - host-based intrusion prevention

Traditional Anti-Virus software was pattern based: it looked for specific sequences of executable code to identify virus threats. The virus writers got smarter, and introduced viruses that scrambled their code as they propagated, defeating the AV efforts. See Virus Research and Defense Bok Review for a detailed look at this whole area.

HIPS instead tries to look at what the program does, either by intercepting system calls or watching packets or other system activity. These may be rule based or may assign scores for certain activity. The problem, of course, is that a program you need to run may generate activity that a HIPS program finds suspicious. This gotcha has so far kept HIPS at the high end of the food chain; home users and small businesss don't usually have the resources to deal with something this complex. A buffer overflow probably indicates malicious code, but it may also just be bad programming. A hardware inventory tool would probably make any HIPS call foul, and so on.

Anything HIPS does is really something that should be in the OS itself, and probably will be in future years. Today, kernels are too much obedient servants, blindly doing the bidding of any program that asks. We have only the very beginning of security in the kernel; most of what we do today is added on. This will change - it has to. Hardware will also play its part in the security picture, but less trusting kernels are necessary.

Click here to add your comments




Wed Sep 21 04:06:11 2005: Subject:   drag


Do you figure that things like SElinux and LSM would prove more usefull for this stuff in the future? By using mandatory access control-like permissions it makes it possible to setup permissions for programs and users based what they need to do in order to operate correctly, but block them and/or throw up red flags when they try to do something unexpected. I figure a person could use this technology to setup a effect HIPS system.

I know right now that it's a pain to setup and pre-setup versions like found in Fedora and Redhat aren't that usefull, but it's reliable and it works and it has already prevented software programming errors into turning into real vunerabilities. But I figure it will mature and advances will make it simplier for the average administrator to configure and deal with.



Wed Sep 21 08:15:34 2005: Subject:   TonyLawrence


Yes, that's part of it, but we need more. I think kernels are going to become much bigger and have more and more intelligence.

Don't miss responses! Subscribe to Comments by RSS or by Email

Click here to add your comments

If you want a picture to show with your comment, go get a Gravatar

Macworld Mac Security Superguide $9.99

Jump to Comments

Many of the products and books I review are things I purchased for my own use. Some were given to me specifically for the purpose of reviewing them. I resell or can earn commissions from the sale of some of these items. Links within these pages may be affiliate links that pay me for referring you to them. That's mostly insignificant amounts of money; whenever it is not I have made my relationship plain. I also may own stock in companies mentioned here. If you have any question, please do feel free to contact me.

Specific links that take you to pages that allow you to purchase the item I reviewed are very likely to pay me a commission. Many of the books I review were given to me by the publishers specifically for the purpose of writing a review. These gifts and referral fees do not affect my opinions; I often give bad reviews anyway.

We use Google third-party advertising companies to serve ads when you visit our website. These companies may use information (not including your name, address, email address, or telephone number) about your visits to this and other websites in order to provide advertisements about goods and services of interest to you. If you would like more information about this practice and to know your choices about not having this information used by these companies, click here.