Suppose I have both network based IDS and host based IDS installed in my environment, will I miss any security attacks if I don't correlate the information from these sources? If so, what are they? It seems that one of these systems should be able to catch any attack whenever they happen, but not sure if I am right about it.

4 Answers 4


I'll turn your question around:

"What attacks can only be detected by a combination of host and network data?"

And the answer to that question is: not many.

The true power of correlation of host and network data is the ability to see 'beyond' the attack to see how widespread it is and where it originated from. In other words, you correlate those two data sets in order to help you respond, not just identify.

An anti-malware detection algorithm can identify an attack on a host, but the other sources of data can provide what you need to eradicate it, not just from the host, but from your entire environment.

The wider view might be considered the 'real' attack, if that's what you meant. And, if you didn't mean that, it should be included in your consideration.


You leave out a bit of key information to consider. For example, when you say "attack" you don't mention what the target asset is running.

In the case of an HTTPS website, most IDS/IPS's don't offer the ability to upload your SSL certificates in order to decrypt the traffic in order to inspect it.

In this case, your IDS/IPS's are providing little to no protection. They can still see and prevent any attacks that are designed to be leveraged during the SSL negotiation/handshaking process but that's it.

This is where a host based agent would be beneficial (or an application firewall) as it will be able to inspect the traffic after it has been decrypted.

The ability to correlate this information comes in handy during forensic investigations, validating false positives, validating security controls (ie: The attack was stopped at the IDS and didn't make it back to the host, which can be correlated via the hosts logs)


Well it depend firstly there are two types of IDS signature based and anomaly based. Signature based IDS work pretty similar to AV you have signatures with well know attack, so the IDS monitor packets on the network and compare them against a database of signatures if the packets are meet to some signature, the IDS will alert you. The other type is anomaly based well this type of IDS collect data and store it into database, and when the IDS see something unusual he will alert. So basicly you will always miss vulnerable places. And in my opinion there's always chance to miss attack vectors, no mater what you do. Hope that this answers your question, if there are any misunderstanding ask in comments.


Correlation is used to reduce false positives. Intrusion Detection Systems are notorious for generating a large number of false positives due to the anomaly based detection. In case of signature based IDS the rate of false positives is reduced but the detection capability is limited to only known attacks for which the IDS has the detection signature.

If you don't correlate the information and analyze the events from both host based IDS and network based IDS individually, you won't miss any attack. However, correlating the two events will make the life of the analyst a lot easier.

Also, correlating the events will help you prioritize the detected attacks. For example, an attack pattern for Windows XP operating system detected by the NIDS will generate an alert on the NIDS interface. However, if the destination IP is a Linux box, you don't need to be alarmed because the attack is bound to fail.

The bottom line is, if you want to reduce the false positive rate and ensure that only those events are detected and acted upon by the analyst which have a high chance of true positive, correlate the events from HIDS and NIDS.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .