Advanced Intrusion Detection Environment

The Advanced Intrusion Detection Environment (AIDE) was initially developed as a free replacement for Tripwire licensed under the terms of the GNU General Public License (GPL).

Advanced Intrusion Detection Environment
Developer(s)Rami Lehti, Pablo Virolainen
Stable release
0.16.1 / February 25, 2019 (2019-02-25)
Preview release
0.16b1[1] / April 15, 2016 (2016-04-15)
Repository
Written inC
Operating systemUnix-like
TypeSecurity (HIDS)
LicenseGNU General Public License
Websiteaide.github.io

The primary developers are named as Rami Lehti and Pablo Virolainen, who are both associated with the Tampere University of Technology, along with Richard van den Berg, an independent Dutch security consultant. The project is used on many Unix-like systems as an inexpensive baseline control and rootkit detection system.

Functionality

AIDE takes a "snapshot" of the state of the system, register hashes, modification times, and other data regarding the files defined by the administrator. This "snapshot" is used to build a database that is saved and may be stored on an external device for safekeeping.

When the administrator wants to run an integrity test, the administrator places the previously built database in an accessible place and commands AIDE to compare the database against the real status of the system. Should a change have happened to the computer between the snapshot creation and the test, AIDE will detect it and report it to the administrator. Alternatively, AIDE can be configured to run on a schedule and report changes daily using scheduling technologies such as cron, which is the default behavior of the Debian AIDE package.[2]

This is mainly useful for security purposes, given that any malicious change which could have happened inside of the system would be reported by AIDE.

gollark: You could look at simple lisp interpreters.
gollark: Anyway, logger reimplementation opinions?
gollark: ++magic reload_ext irc_link
gollark: Ughhhhhh. I thought I had autoreconnect.
gollark: Thoughts?

See also

References
  1. "Aide / Code / [6be695]". Retrieved 6 June 2016.
  2. "Using Aide on Ubuntu 12.04 LTS (Precise Pangolin) and Debian 7 (Wheezy)". Archived from the original on 9 January 2013. Retrieved 12 March 2013.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.