Intrusion Detection System (IDS)

Intrusion detection is the process of monitoring the events on a computer system or network and analyzing them for signs of possible incidents, meaning violations or imminent threats of violation of security policies, acceptable use policies, or standard security practices. An IDS automates that process. It records information about observed events, notifies security administrators of important ones, and produces reports.

IDS technologies differ mainly in the events they monitor. A network-based IDS monitors traffic for particular network segments or devices. A wireless IDS monitors wireless network traffic. Network behavior analysis looks for threats that generate unusual traffic flows, such as distributed denial of service attacks. A host-based IDS monitors a single host and the events occurring on it. NIST recommends using more than one type, and for most environments a combination of network-based and host-based detection is needed.

Detection relies on three main methods. Signature-based detection compares observed events against patterns that correspond to known threats; it is very effective against known threats but largely ineffective against previously unknown threats, threats disguised by evasion techniques, and many variants of known threats. Anomaly-based detection compares observed events against profiles of normal activity and can be very effective at detecting previously unknown threats. Stateful protocol analysis compares activity against predetermined profiles of benign protocol behavior.

No IDS detects with complete accuracy. A false positive flags benign activity as malicious, a false negative misses malicious activity, and reducing one usually increases the other. Changing the configuration to improve accuracy is called tuning. IDS components are themselves targets for attackers who want to avoid detection or reach the sensitive information they hold, so they need to be secured and kept up to date.