An Intrusion Detection System (IDS) is a security technology designed to monitor network traffic or host activities and identify malicious or unauthorized activities. The primary purpose of an IDS is to detect potential security breaches or intrusion attempts and generate alerts to notify system administrators or security personnel.
There are two main types of IDS: network-based IDS (NIDS) and host-based IDS (HIDS).
Network-based IDS (NIDS): A NIDS monitors network traffic in real-time and analyzes it for suspicious patterns or known attack signatures. It operates at the network level, examining packets flowing through network devices such as routers, switches, or dedicated IDS sensors. NIDS can detect network-based attacks like port scanning, denial-of-service (DoS) attacks, or attempts to exploit vulnerabilities in network services.
Host-based IDS (HIDS): A HIDS focuses on individual hosts or servers and monitors their activities, including file system changes, log file analysis, and system calls. HIDS can detect attacks that may go unnoticed by network-based systems, such as unauthorized access to files, suspicious user activities, or malware infections on a specific host.