AIDE

Definition

AIDE, short for Advanced Intrusion Detection Environment, is an open-source file and directory integrity checker that builds a baseline database of cryptographic hashes and metadata for specified files, then later compares the current filesystem state against that baseline to detect unauthorized changes. It is commonly used on Linux servers to spot signs of compromise, such as a tampered system binary or an unexpectedly modified configuration file, that other security tools focused on network or process activity might not directly reveal.

Overview

AIDE exists to answer a specific question that many security tools do not directly address: has a particular file on this system been changed since it was last known to be trustworthy? Malware or an intruder with system access frequently modifies binaries, configuration files, or scheduled tasks to maintain persistence or hide their presence, and those changes are not always visible through network monitoring or process inspection alone, especially if the malicious activity is designed to blend in with legitimate system behavior. Mechanically, an administrator first configures AIDE with a set of rules specifying which directories and files to monitor and which attributes to track for each, such as file size, permissions, ownership, modification timestamps, and one or more cryptographic hash algorithms. AIDE then scans the filesystem according to those rules and stores the results in a baseline database. On subsequent runs, typically scheduled periodically via a cron job, AIDE recomputes the same attributes and compares them against the stored baseline, reporting any additions, deletions, or modifications that fall outside the configured rules. Among file integrity monitoring tools, AIDE is often compared to Tripwire, which pioneered the same core concept of baseline-and-compare file integrity checking; AIDE distinguishes itself primarily by being fully open-source and freely available, whereas Tripwire's original commercial product added centralized management and reporting features around a similar underlying mechanism, with an open-source Tripwire variant also existing alongside the commercial one. AIDE is a point-in-time, on-demand or scheduled checker rather than a continuous real-time monitor, which sets it apart from network-facing intrusion detection tools like Snort or Suricata that inspect traffic as it happens. In practice, administrators typically run an initial AIDE scan immediately after provisioning a server, store the resulting baseline database somewhere it cannot be tampered with by the monitored system itself, such as read-only media or a separate host, and then schedule regular comparison scans that alert on any unexpected file changes, prompting investigation of whether a change was a legitimate administrative action or a sign of compromise. A key limitation is that AIDE's usefulness depends entirely on protecting the integrity of its own baseline database and configuration; if an attacker with sufficient access modifies the baseline itself alongside the files it protects, the tool will no longer detect the discrepancy, which is why baseline storage on separate, write-protected media is considered an essential part of a correct AIDE deployment rather than an optional precaution.

Key Features

• Baseline database of file hashes, permissions, and metadata for monitored paths
• Scheduled or on-demand comparison scans against the stored baseline
• Configurable rules specifying which directories and attributes to track
• Detection of unauthorized file additions, deletions, or modifications
• Open-source alternative to commercial file integrity monitoring tools
• Point-in-time checking rather than continuous real-time monitoring
• Commonly run via scheduled cron jobs on Linux servers
• Requires baseline storage on protected media to prevent tampering

Use Cases

Alternatives

Frequently Asked Questions

Related in Cybersecurity