Review of Approaches to Implementing Intrusion Detection and Prevention Subsystems within a SOC

Abstract

Modern corporate networks face growing threats from cyberattacks, necessitating the use of advanced security technologies. This paper presents an analytical review of methods for implementing intrusion detection and prevention subsystems (IDS/IPS) within Security Operations Centers (SOC).

Theoretical aspects of network- and host-based solutions (NIDS, HIDS, NIPS, HIPS), as well as network behavior analysis (NBA) methods, are discussed. The study analyzes current approaches to integrating technologies such as Suricata, Zeek, and Security Onion, exploring their functionality, operational principles, and comparative effectiveness.

Special attention is given to event correlation, reduction of false positives, interaction with SIEM systems, and the automation of incident response processes. The paper examines the advantages and disadvantages of various technologies and proposes a comprehensive approach to securing corporate networks.

Finally, recommendations are provided for selecting optimal solutions to build a resilient security system capable of effectively countering modern cyber threats.