Intrusion Detection SystemsOverview
What are Intrusion Detection Systems?
Intrusion detection systems (IDS) are software products that monitor network or system activities, and analyze them for signs of any violations of policy, acceptable use, or standard security practices. They then report any malicious activities or policy violations to system administrators.
Intrusion detection systems are concerned primarily with identifying potential incidents and logging information about them and notifying administrators of observed events. However some systems, usually called instruction prevention systems, actively try to prevent intrusion threats from succeeding.
Types of Intrusion Detection Software
- Network-based systems: Network-based systems monitor network traffic for network segments or devices to identify suspicious activity
- Wireless monitoring: Wireless systems monitor wireless network traffic and analyze it to identify suspicious activity involving wireless networking protocols
- Network behavior analysis: Network behavior analysis systems monitor network traffic to identify threats generating unusual traffic flows like denial of service attacks, malware or policy violations
- Host-based systems: Host-based systems monitor the characteristics of a single host and events occurring within that host
