An intrusion detection system watches network traffic or host activity for signs of an attack. It alerts when something looks wrong. It does not block. That is the difference from an intrusion prevention system, which sits inline and can drop traffic. An IDS is passive. It observes, analyzes, and reports. The analyst decides what to do.

Detection methods vary. Signature-based systems match known attack patterns. They catch what they have seen before and miss everything else. Anomaly-based systems build a baseline of normal behavior and flag deviations. They catch novel attacks but generate more false positives. Most deployments use both. Network-based IDS monitors traffic at strategic points. Host-based IDS watches processes, file changes, and system calls on individual machines. The volume of alerts is the constant problem. A poorly tuned IDS drowns analysts in noise. They stop paying attention. Real alerts get missed. Tuning is not a one-time task. Networks change. New applications appear. The baseline shifts. An IDS that was well-tuned last year may be useless today.

IDS types

• Network-based — monitors traffic at network taps
• Host-based — monitors activity on individual devices
• Signature-based — matches known attack patterns
• Anomaly-based — flags deviations from normal behavior

An IDS is a smoke detector. It does not put out the fire. It tells you there is one.