Patriot NG: Host Based Intrusion Detection System

Intrusion detection system (IDS) is very popular in the field of network security, for a complete disclosure of IDS read our previous article about it click here to understand IDS from basic, and click here learn about different types of IDS.

Patriot NG is host based IDS, and it is design to work on Microsoft plate form, Patriot NG allows real time monitoring of operating system and the network.

As by using the previous articles you have an idea what actually a host based IDS is? What it does? 

Patriot NG is available on windows XP,VISTA and 7 plate form and it applicable on both 32-bit and 64-bit system.

Key Feature 

• Changes in Registry keys: Indicating whether any sensitive key (autorun, internet explorer settings...) is altered.

• New files in 'Startup' directories

• New Users in the System

• New Services installed

• Changes in the hosts file

• New scheduled jobs

• Alteration of the integrity of Internet Explorer: (New BHOs, configuration changes, new toolbars)

• Changes in ARP table (Prevention of MITM attacks)

• TCP/IP Defense (New open ports, new connections made by processes, PortScan detection...)

• Files in critical directories (New executables, new DLLs...)

• NIDS (Detect anomalous network traffic based on editable rules)

Options

• Windows contain a host file that stores the information about the host that is IP addresses of a system, some malware affect this host file and change the data.Patriot NG alert the administrator if this will happen.
• New window may be occur on a background of this current windows this might be happen via malware. Whenever this thing happen Patriot NG warn you.
• Patriot NG provide us a facility of securing the critical system files, when ever new changes has been made on a critical file system it warn you.
• Patriot NG has a built-in function to secure the TCP/IP, when ever new port open it warn us, the port may be open via back door like netcat.  
• When the new services will install on a system, patriot NG inform the administrator about it.
• It is highly recommended to use patriot NG along Winpcap.
• Patriot NG warn the administrator if a new driver will install on a system, some malware behave like a driver and they may install on a critical system file. 

Download

Windows XP, Windows Vista, Windows 7 (32Bits)
Patriot NG 2.0

Windows XP, Windows Vista, Windows 7 (64Bits)
PatriotNG 2.0

Video Demonstration 

Note: If you enjoyed this post, you might want to subscribe our RSS feed and Email Subscription  or become our Facebook fan! You will get all the latest updates at both the places.