Intrusion Detection System (IDS)

An intrusion detection system monitors activity for signs of attack and alerts when it finds them. A network-based IDS (NIDS) watches traffic on a segment; a host-based IDS (HIDS) watches a single machine’s logs, processes, and file changes. Detection works in two ways: signature-based matching against known attack patterns, and anomaly-based flagging of deviations from a learned baseline of normal behaviour. Alerts typically feed a SIEM for correlation with other sources.

The defining limit is that an IDS detects and alerts; it sits out of band and blocks nothing. An intrusion prevention system (IPS) is the inline variant that can drop malicious traffic itself, at the price of becoming a potential bottleneck and a single point of failure. The detection methods trade off differently too: signatures produce few false positives but miss novel attacks (false negatives), while anomaly detection can catch zero-days but floods analysts with false positives until the baseline is well tuned.

Exam relevance: if a scenario asks for detection and alerting without touching traffic, the answer is IDS; if the device must sit inline and block, the answer is IPS. “Known attack patterns” points to signature-based detection, “deviation from a baseline” to anomaly-based. Contrast the IDS with a honeypot, which does not watch production traffic at all but lures attackers to a decoy so their methods can be studied.