Intrusion Detection System
Network and Host-Based Intrusion Detection and Response Framework · Also known as: IDS, Network Intrusion Detection, Anomaly Detection System
An Intrusion Detection System (IDS) is a security tool that monitors network traffic and system activity to identify unauthorized access attempts, malware infections, and policy violations. Introduced by Dorothy Denning in 1987, IDS employs two main detection paradigms: signature-based (matching known attack patterns) and anomaly-based (identifying deviations from normal behavior).
Read the full method
Sign in with a free account to read this section.
Method map
The neighbourhood of related methods — select a node to explore.
When to use it
Deploy IDS at network perimeters (between internet and internal network) to detect external attacks, and on critical internal systems to detect insider threats. Use signature-based IDS for detecting known attacks with low false-positive rates; combine with anomaly-based IDS to catch novel attacks. Organizations should implement both network IDS (NIDS) and host-based IDS (HIDS) for defense-in-depth. IDS is essential in regulated environments (financial services, healthcare) where intrusion monitoring is mandated.
Strengths & limitations
- Provides real-time detection of active attacks without blocking legitimate traffic
- Signature-based detection is fast and produces few false positives for known attacks
- Anomaly-based detection can identify novel, previously unknown attacks
- Generates forensic logs for incident investigation and regulatory compliance
- Signature-based systems cannot detect zero-day attacks (unknown vulnerabilities)
- Anomaly-based systems suffer from high false-positive rates in complex networks
- IDS cannot prevent attacks—only detect them; protection requires additional controls (firewall, patching)
- High-volume network traffic creates monitoring and storage challenges; sampling or filtering may miss attacks
Frequently asked
What is the difference between IDS and a firewall?
A firewall enforces access control policies by allowing or denying traffic based on predefined rules (e.g., block port 23). An IDS monitors traffic to detect intrusions and suspicious behavior. Firewalls are proactive barriers; IDS is reactive detection. Both are necessary for defense-in-depth: the firewall blocks known threats, and IDS detects attacks that bypass the firewall.
Why do anomaly-based IDS have high false-positive rates?
Anomaly-based systems learn a baseline of 'normal' activity and alert on deviations. However, legitimate but unusual activities (software deployments, backups, legitimate large transfers) can trigger false alarms. As networks evolve and legitimate activity patterns change, baselines become outdated, requiring continuous tuning.
Can IDS detect encrypted traffic intrusions?
Traditional IDS cannot decrypt encrypted traffic (respecting privacy). However, modern systems analyze traffic metadata (flows, timing, packet sizes, volumes) to detect anomalies even without payload visibility. Some enterprise systems perform decryption on-path (with security risks), or organizations deploy host-based IDS that monitor encrypted content after decryption.
What is the difference between IDS and IPS?
An IDS (Intrusion Detection System) detects attacks and alerts. An IPS (Intrusion Prevention System) goes further, automatically taking action to block or prevent the attack (dropping packets, resetting connections). IPS is more aggressive and can block legitimate traffic if misconfigured; IDS is safer but requires manual response.
Sources
- Denning, D. E. (1987). An intrusion-detection model. IEEE Transactions on Software Engineering, 13(2), 222–232. DOI: 10.1109/TSE.1987.232894 ↗
- Lippmann, R. P., Kunkel, J. W., Base, D. J., Haines, J. W., Fried, D. J., Webster, S. E., & Wyschogrod, D. B. (2000). 1999 DARPA intrusion detection evaluation: Datasets. Technical Report, MIT Lincoln Laboratory. link ↗
- Garcia-Teodoro, P., Diaz-Verdejo, J., Maciá-Fernández, G., & García-Alonso, J. (2009). Anomaly-based network intrusion detection: Techniques, systems and challenges. Computers & Security, 28(1–2), 18–28. DOI: 10.1016/j.cose.2008.08.003 ↗
How to cite this page
ScholarGate. (2026, June 3). Network and Host-Based Intrusion Detection and Response Framework. ScholarGate. https://scholargate.app/en/cryptography/intrusion-detection-system
Which method?
Set this method beside its closest kin and read them side by side — the library lays the books on the table; the choice is yours.
- Penetration Testing MethodologyCryptography↔ compare
- TLS Protocol AnalysisCryptography↔ compare
- Vulnerability AssessmentCryptography↔ compare