View source for Application protocol-based intrusion detection system

An '''application protocol-based intrusion detection system''' ('''APIDS''') is an [[Intrusion detection system|intrusion detection system]] that focuses its monitoring and analysis on a specific application protocol or protocols in use by the computing system.

== Overview ==
An APIDS will monitor the dynamic behavior and [[State (computer science)|state]] of the protocol and will typically consist of a system or agent that would typically sit between a [[Process (computing)|process]], or group of [[Server (computing)|server]]s, monitoring and analyzing the application protocol between two connected devices.

A typical place for an APIDS would be between a [[Web server|web server]] and the database management system, monitoring the [[SQL]] protocol specific to the [[Middleware|middleware]]/[[Business logic|business logic]] as it interacts with the [[Database|database]].

== Monitoring dynamic behavior ==
At a basic level an APIDS would look for, and enforce, the correct (legal) use of the protocol.

However at a more advanced level the APIDS can learn, be taught or even reduce what is often an infinite protocol set, to an acceptable understanding of the [[Subset|subset]] of that application protocol that is used by the application being monitored/protected.

Thus, an APIDS, correctly configured, will allow an application to be "[[Biology:Fingerprint|fingerprint]]ed", thus should that application be subverted or changed, so will the fingerprint change.

==See also==
* [[Intrusion detection system]] (IDS)
* [[Application firewall|Web application firewall (WAF)]]

[[Category:Intrusion detection systems]]

es:APIDS
ko:호스트 기반 침입 탐지 시스템

{{Sourceattribution|Application protocol-based intrusion detection system}}