Intrusion detection system

Intrusion Detection System (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any detected activity or violation is typically reported either to an administrator or collected centrally using a security information and event management (SIEM) system.

Types of Intrusion Detection Systems

There are several ways to categorize IDS depending on the context.

Network Intrusion Detection Systems (NIDS)

Network Intrusion Detection Systems (NIDS) are placed at a strategic point or points within the network to monitor traffic to and from all devices on the network. It performs an analysis of passing traffic on the entire subnet and matches the traffic that is passed on the subnets to the library of known attacks.

Host Intrusion Detection Systems (HIDS)

Host Intrusion Detection Systems (HIDS) run on individual hosts or devices on the network. A HIDS monitors the inbound and outbound packets from the device only and will alert the user or administrator if suspicious activity is detected.

Signature-based IDS

Signature-based IDS will monitor packets in the network and compare them against a database of signatures or attributes from known malicious threats. This is similar to the way most antivirus software detects malware.

Anomaly-based IDS

Anomaly-based IDS will monitor network traffic and compare it against an established baseline. The baseline will identify what is "normal" for that network—what sort of bandwidth is generally used, what protocols are used, what ports and devices generally connect to each other—and alert the administrator when traffic is detected which is anomalous, or significantly different, from the baseline.

See also

• Firewall
• Intrusion prevention system
• Security information and event management
• Computer and network surveillance
• Anti-virus software