CONCEPT OF THE SYSTEM OF DETECTION AND PREVENTION OF NETWORKS

Abstract

Detecting and preventing network attacks is one of the most important tasks of a network security system. It is now difficult to find a network that does not have such active attack prevention tools as antivirus, firewall, intrusion prevention and detection systems. Unfortunately, active means of repelling attacks alone are not enough. Therefore, in addition, passive means of combating attacks are used - network intrusion detection systems. Therefore, this article is devoted to protecting computer networks from attacks, intrusions and unauthorized access. Particular attention is paid to the principle of operation of network systems for detection and prevention of intrusions. This article discusses the different types of intrusion detection mechanisms and the benefits of their use. Intrusion prevention systems that operate on the basis of rules and anomalies are also analyzed in detail. Behavioral analytics of UEBA users and objects for detection of security breaches are considered. As an example, we used Microsoft ATA and Azure Security Center, which was used as a hybrid solution for behavioral analysis of computer network users. The example of the Azure Security Center explores intelligent security tools and the expansion of analytics to more quickly detect threats and reduce the number of false alarms. Based on the considered concept of detection and prevention of intrusions, it is possible to build an effective notification system for network protection.