Introduction

Introduction

In modern warfare, attacks occur in a very
short period of time. The ability to thwart and repel an attack depends greatly
on how early it can be detected. Radar, satellites, and other monitoring and
surveillance systems are regularly used to detect any hostile activity. However,
even in warfare, intrusion detection isn't 100% accurate. The Iraqis used
cardboard mock-up models of Soviet T-72 tanks, which were detected by satellite
photography and led the allied forces to think that they were real tanks.

Intrusion detection systems for computer
networks function in a manner similar to those of warfare intrusion detection
systems. All activity is monitored, and a decision is made about whether an
activity is hostile.

In this chapter, we discuss how intrusion
detection systems can be used to detect Web attacks, and conversely, how some
Web attacks can be crafted to fool intrusion detection systems.