The network-based intrusion detection system is mainly used to monitor the information of the critical path of the network in real time, listen to all packets on the network, collect data, and divide Analyze the suspicious object, which of the following options are its main features? (multiple choices)
- Good concealment, the network-based monitor does not run other applications, does not provide network services, and may not respond to other computers, so Not vulnerable to attack.
- The monitoring speed is fast (the problem can be found in microseconds or seconds, and the host- based DS needs to take an analysis of the audit transcripts in the last few minutes
- Need a lot of monitors.
- It can detect the source address and destination address, identify whether the address is illegal, and locate the real intruder.