Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I'm a little bit confused about what a host-based intrusion prevention system is.
In order to better understand this concept, I'd like to introduce you a case.
Let's say someone designed the following software:
Could this software be called a host-based intrusion prevention system?
If not can you tell me why?
The software must be installed on a host.
Yes, you need to install it :)
The software is designed to protect a single host.
Yes, by definition, HIDS focuses on a single host/endpoint.
The software checks network packets sent to the host against a set of signatures.
I prefer to quote you this directly from an official and reliable source in this field:
HIDS work primarily by monitory system logs and behavior and can be signature based (include rule sets that enforce tailored security policies) or behavioral based. Most organizations use both types of IDSs. They use HIDSs to secure critical host systems and NIDSs to secure their network(s).
Regarding the description you gave, the answer is definitely Yes.
