Chapter 2. Introduction to Filters and Signatures

To search for only some of the traffic that passes by an intrusion detection filter—that is, to find the specific events that are of interest—you need to tell the sensor what to look for. A signature defines or describes a traffic pattern of interest. A filter transcribes the signature description into either machine-readable code or lookup tables, which tell the sensor which traffic you want to find. This chapter continues the process of diving straight into intrusion detection and takes a close look at working intrusion detection filters.