Prab at 12:53, 18 March 2025

2025-03-18T12:53:02Z

← Older revision		Revision as of 12:53, 18 March 2025
Line 37:		Line 37:
	{{Computer-security-stub}}		{{Computer-security-stub}}
	{{No image}}		{{No image}}
	~~__NOINDEX__~~

Prab: CSV import

2025-03-17T15:21:48Z

CSV import

← Older revision		Revision as of 15:21, 17 March 2025
Line 37:		Line 37:
	{{Computer-security-stub}}		{{Computer-security-stub}}
	{{No image}}		{{No image}}
			__NOINDEX__

Prab: CSV import

2025-02-11T02:27:01Z

CSV import

← Older revision		Revision as of 02:27, 11 February 2025
Line 36:		Line 36:
	[[Category:Intrusion detection system]]		[[Category:Intrusion detection system]]
	{{Computer-security-stub}}		{{Computer-security-stub}}
			{{No image}}

Prab: CSV import

2024-03-02T02:41:32Z

CSV import

New page

'''Intrusion Detection System''' ('''IDS''') is a device or software application that monitors a network or systems for malicious activity or policy violations. Any detected activity or violation is typically reported either to an administrator or collected centrally using a security information and event management (SIEM) system.

== Types of Intrusion Detection Systems ==

There are several ways to categorize IDS depending on the context.

=== Network Intrusion Detection Systems (NIDS) ===

[[Network Intrusion Detection Systems]] (NIDS) are placed at a strategic point or points within the network to monitor traffic to and from all devices on the network. It performs an analysis of passing traffic on the entire subnet and matches the traffic that is passed on the subnets to the library of known attacks.

=== Host Intrusion Detection Systems (HIDS) ===

[[Host Intrusion Detection Systems]] (HIDS) run on individual hosts or devices on the network. A HIDS monitors the inbound and outbound packets from the device only and will alert the user or administrator if suspicious activity is detected.

=== Signature-based IDS ===

[[Signature-based IDS]] will monitor packets in the network and compare them against a database of signatures or attributes from known malicious threats. This is similar to the way most antivirus software detects malware.

=== Anomaly-based IDS ===

[[Anomaly-based IDS]] will monitor network traffic and compare it against an established baseline. The baseline will identify what is "normal" for that network—what sort of bandwidth is generally used, what protocols are used, what ports and devices generally connect to each other—and alert the administrator when traffic is detected which is anomalous, or significantly different, from the baseline.

== See also ==

* [[Firewall (computing)|Firewall]]
* [[Intrusion prevention system]]
* [[Security information and event management]]
* [[Computer and network surveillance]]
* [[Anti-virus software]]

== References ==

<references />

[[Category:Computer security]]
[[Category:Intrusion detection system]]
{{Computer-security-stub}}

Intrusion detection system - Revision history

Prab at 12:53, 18 March 2025

Prab: CSV import

Prab: CSV import

Prab: CSV import