Introduction

Introduction

In modern warfare, attacks occur in a very short period of time. The ability to thwart and repel an attack depends greatly on how early it can be detected. Radar, satellites, and other monitoring and surveillance systems are regularly used to detect any hostile activity. However, even in warfare, intrusion detection isn't 100% accurate. The Iraqis used cardboard mock-up models of Soviet T-72 tanks, which were detected by satellite photography and led the allied forces to think that they were real tanks.

Intrusion detection systems for computer networks function in a manner similar to those of warfare intrusion detection systems. All activity is monitored, and a decision is made about whether an activity is hostile.

In this chapter, we discuss how intrusion detection systems can be used to detect Web attacks, and conversely, how some Web attacks can be crafted to fool intrusion detection systems.