Intrusion Detection: Detection Methods & NIDS vs. HIDS

An Intrusion Detection System (IDS) monitors network or host activity for signs of malicious behavior and generates alerts. It's generally passive -- unlike an Intrusion Prevention System (IPS), which sits inline and can actively block traffic in real time.

Signature-Based Detection

Matches observed traffic against a database of known attack patterns -- similar in concept to antivirus signature matching. Its key limitation: it can't detect a genuinely novel attack (a zero-day) with no existing signature.

Anomaly-Based Detection

Establishes a baseline of normal behavior and flags significant deviations from it -- potentially catching novel attacks a signature-based system would miss, at the cost of a higher risk of false positives when normal behavior legitimately varies.

NIDS vs. HIDS

• NIDS (Network-based) -- sits at a strategic network point (a tap or span port), inspecting traffic flowing through it.

• HIDS (Host-based) -- runs on a specific machine, monitoring its logs, file integrity, and local activity.

• Deploying both gives more complete visibility -- an insider using a local exploit might never traverse a monitored network segment, while a broad network scan might never touch any single host's logs.

Out-of-Band Deployment

A detection-only IDS commonly inspects a mirrored copy of traffic, so it can't block anything (that's an IPS's job) but also doesn't add latency or become a network chokepoint if it fails.