File Integrity Checkers: Functionality, Attacks, and Protection

Abstract

Intrusion detection systems are a critical component of a network's security. Intrusion detection systems exist in a variety of shapes and sizes, with various methodologies and analytic procedures. Host-based intrusion detection systems, or HIDS, are intrusion detection systems that operate at the host level and use a signature database (DB) or a profile to do detection analysis. The integrity of the database is fully dependent on the detection in all host-based systems. If an attacker can edit the database to his liking, he can simply circumvent the HIDS. In this paper, we have focused our study on file integrity checking HIDS. An endeavor has been made to study this specific type of HIDs functionality and various attacks against its trusted operation. Different techniques used to secure the system database have been studied, however, none are found to be flawless. We conclude that the use of Blockchain can be a viable solution in the future to secure the critical database integrity in such systems.