Running AIDE quickly alerts you to unexplained changes in your system files, which could indicate an intrusion. If Microsoft had been running the equivalent of AIDE , they would have detected the break-in within minutes or hours. Snort Snort bills itself as 'a lightweight network intrusion detection system, capable of performing real-time traffic analysis and packet logging on IP networks'. Snort is a network sniffer which detects and logs suspicious network traffic. Thus, it is useful to detect intrusion attempts on any machine in a network.
Snort works by listening to all the network traffic and comparing what it sees to various rules.
These rules specify data patterns used by common Trojans, suspicious port numbers, and so on. This lets you detect intrusion as it is happening and quickly react to it. Again, if Microsoft had used the equivalent of Snort , they would have been alerted to the Trojan's presence within seconds or minutes. The Microsoft break-in should also teach Linux application developers some lessons. With the desire to move Linux into the desktop market, some application developers are adding 'convenient' features without fully thinking about the security implications.