Host-based Intrusion Prevention System (HIPS)
- •
def
- •
a host-level system that recognizes and blocks known attacks, secures OS/application configurations, and validates incoming service requests — often built into endpoint protection software
- •
- •
identification methods
- •
signatures, heuristics, behavioral analysis
- •
- •
examples watched for
- •
buffer overflows, registry updates, writing files to protected system folders, access to non-encrypted data
- •
- •