Question

Based on your findings, compare and contrast the different types of malware detection methodologies. Explain how you would deploy and maintain IDS with up-to-date signatures, changes in traffic patterns, and deviations that are common on computing infrastructures.

Answer 1

Malware -A malicious software which is used for intruding computer system’s security that include integrity confidentiality,and availability of data.
Malware Detection-Malware detection methodology is used to identify whether a program has malicious or not.
Different types of malware detection-Malware detection techniques is of three types.

1)Signature - In malware a sequence of bit which is known as signature is identified by antivirus. the signature of
malware are stored in a database for matching.that why it is also known as matching.it is either static ,dynamic or hybrid.
Only known malware can be detected owing to signature.It uses minimum no of resources. Unknown malware can not be detected
2)Heuristic - In heuristic detection technique the behavior of system is identified i.e. whether its behavior of system is
normal or not.The system's behavior detection can be done by Data collection ,Interpretation and by using matching algorithm.So in this technique new malware can be detected also.It uses machine learning and AI methods for detecting malware.But problem is that it uses more resources and data need to be modified for new malware.
3)Specification- In this technique applications are watched according to behavior of system.It is based on the analysis of the behavior that are described in the system specification.In this technique a new malware whether it is Known , unknown or new malware can be detected.It is not much efficient in detection of new malware and specification development of system is time consuming process.

Deployment and maintaining of IDS-Installing a Network IDS (NIDS) onto a network requires planning. Initial Industry Standard IDS deployment dictates use of network-based IDS, then host-based IDS. This ensures the
network, and then host devices are protected.First of all we must determine policy, junction of maintenance after that
Comparing IPS and IDS should be done.And then gather network topology diagram, identify physical infrastructure,network name and network function.
Update signatures- for fully protected, it is important that one regularly update the list of attacks an IDS is
configured to recognize. Intruders constantly change attack styles, so optimal protection requires updating the IDS
signature files as often as possible.
we use anomaly-based malware detection for computing systems and network traffic.