0

I'm currently reading about Intrusion Detection Systems (IDS) and noticed a huge variety of definitions for the term of Deep Packet Inspection. Especially the NIST shows three different techniques in their paper "Guide to Intrusion Detection and Prevention Systems" which are:

  • Signature-Based Detection
  • Anomaly-Based Detection
  • Stateful Protocol Analysis

In a footnote they state that Stateful Protocol Analysis is basically just another term for DPI, which seems fine for me. However Signature-Based Detection is supposed to detect malicious behaviour by comparing signatures of e.g. packets with a given Dataset of known attacks.

This requires in my understanding unpacking data in case of network IDS up to the application layer and actually analyse the packet's data, which sounds like a definition of DPI to me.

On the other hand DPI is defined in various sources as the sum of IDS/IPS and a stateful firewall. Each definition of the term is somehow depending on the other term. Can someone give me a clear and correct definition of IDS in respect to DPI and vice versa?

Improve this question

2 Answers 2

Reset to default
3

IDS can cover deep packet inspection, or a simple look at connection types, or anything in between. You can have Network IDS or Host IDS, depending on what you want to focus your attention on.

  • DPI is a very specific type of analysis of packet contents in order to understand what the purpose of the communication is.
  • Signature Based Detection does not require any deep packet analysis - it is simpler and faster than DPI (which can also be known as Stateful Protocol Analysis)

There is no one-to-one relationship between IDS or DPI, or in fact any other acronyms touted by companies. They are simply ways to describe a service or product, and different vendors use different terms.

Improve this answer
2
  • Thanks for your answer. But how is Signature Based Detection supposed to work when it does not perform DPI? Generating Signatures over a whole packet with checksums, TTL, or application layer specific counters, etc. will make it impossible to compare them to a given signature set?
    – Quxflux
    Commented Feb 10, 2016 at 9:52
  • 1
    I think you misunderstand "Deep". Signature based detection can look at the packet and do a quick match of the content. DPI may reconstruct an entire communication, analyse any commands found etc
    – Rory Alsop ♦
    Commented Feb 10, 2016 at 9:55
0

Can someone give me a clear and correct definition of IDS in respect to DPI and vice versa?

I think there is none.

IDS, IPS, Firewall, NGFW, UTM, DPI ... are terms which describe a task but not how is the task technically implemented. This results in a wide variety of solutions which all use the same terms and buzzwords but vary a lot in the capabilities and technical implementations.

You will find quick and dirty DPI for packet classification in telecom networks so that packets can prioritized. You will find a different quality of DPI in IDS, IPS, NGFW... so that they can look into the application traffic to detects attacks. The only thing that all these DPI have in common is that they look deeper than only at source and destination. But it says nothing how deep they look, how good they are at looking and what the result can be used for - i.e. only classification or also attack detection.

The same is true for IDS - which only says that it somehow detects some kind of intrusions. It does not say anything about the level of detection (packet based vs. stream based), about the depth and quality of the used DPI etc. But you can say that each IDS will probably employ some DPI techniques.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .