|
DERBI is a different kind of intrusion detection system. Rather than instrumenting a computer system to detect intrusions in real time, DERBI is designed to analyze a computer’s file systems after-the-fact to see if there is evidence of an intrusion. Obviously, DERBI is not intended to supplant a real-time IDS, as it is better to stop an intrusion before it happens. However, in a well-protected site, DERBI could be used in conjunction with a traditional IDS. If an attack somehow avoids or neutralizes the IDS, DERBI may be able to detect information useful in determining whether there was an attack and what happened. | |
