An Overview of Strategy Based Approaches in Combating Intrusion and Threats

Abstract

Recently the competitiveness of any Security product is determined by the efficiency to deal with spy ware and to manage any given threat from detection to full removal. Detecting and removing installed and active threats presents many challenges, particularly where multiple files, processes and registry components are involved. The ability for these components to be updated from the Internet at any time and with varying frequency only complicates the issue further. In some cases the threats can be removed in safe mode only, but the Antivirus products are normally inactive in safe mode, this is a major challenge for the Security products. Some root kits affects the host files which makes website redirection issues and finally make the Antivirus product out of phase. This paper looks at how organizations and users can benefit from a more integrated, strategy-driven approach to protecting the network at all levels and controlling both user access and behavior by combating modern threats. This paper also describes about the recent infections like root kits which cannot be automatically removed by the Antivirus products and some of the manual removal techniques used for those infections and the general locations where the threats gets affected. Intrusion Detection System (IDS) has been used to secure these environments for sharing their data over network and host based IDS approaches. The rapid improvements of intrusions in internet and other networks are the main factors responsible for the propagation of different threats and vulnerabilities in the computing environment. Now a days the Ids makes use of the signature based detection approach which detects the actions based on analyzing the patterns such as text, password, time etc. So this will create difficulties in updating information and detecting unknown attacks. In this paper we make use of an improved EADS (Exception Agent Detection System) for making the header information secure.. We establish the conditions under which the IDPF framework works correctly in that it does not discard packets with valid source addresses. In this paper we also propose an improved behavioral method for combating the unknown threats other that the usual context and content scanning techniques