- 2071 Shrawan · 4 marks
Short note: IDS
Short answer
An IDS monitors network traffic or host activity for malicious behavior and alerts administrators but does not block traffic. Types include NIDS (network-based, e.g., Snort) and HIDS (host-based, e.g., OSSEC). Detection methods are signature-based (matches known patterns, low false positives) and anomaly-based (detects deviations from normal, higher false positives). IDS complements firewalls by detecting attacks that bypass rule-based filtering.
Write a short note on IDS.
An IDS (Intrusion Detection System) is a hardware or software system that monitors network traffic or host activity for malicious behaviour or policy violations and raises an alert to the administrator. It detects but does not by itself block; an IPS (Intrusion Prevention System) is placed in line and can also drop the offending traffic.
Types by location
- NIDS (Network-based): sensors on a network segment (switch mirror port) inspect packets, e.g. Snort, Suricata.
- HIDS (Host-based): software on a host watches system logs, file changes and processes, e.g. OSSEC, Tripwire.
Detection methods
| Method | Idea | Pro | Con |
|---|---|---|---|
| Signature-based (misuse) | Compares traffic with a database of known attack patterns | Few false alarms | Cannot detect new attacks |
| Anomaly-based | Learns normal behaviour; flags deviations | Detects unknown attacks | More false positives |
Internet --[Firewall]--+-- LAN
|
[ NIDS ] -> Alert / log -> Admin
Role
IDS works together with firewalls: the firewall blocks according to rules, and the IDS spots attacks that pass through (port scans, DoS, buffer overflow, malware), and it supports logging and forensics.
✓ Answer checked by Claude Opus 5.5 (high effort)