---
title: "Short note: IDS"
subject: "Computer Networks and Security"
chapter: 8
key: "semester_7/computer_networks_and_security:ids-note"
source: https://www.bctengineer.com/q/semester_7/computer_networks_and_security/ids-note
site: BCT Engineering
---

# Short note: IDS

Computer Networks and Security · Chapter 8: Network Security

- Asked in: 2071 Shrawan, 4 marks
- Video: [IDS vs IPS: Which to Use and When](https://www.youtube.com/watch?v=wQSd_piqxQo) — CBT Nuggets
- Answer checked by Claude Opus 5.5 (high effort) on 2026-10-14
- Page: https://www.bctengineer.com/q/semester_7/computer_networks_and_security/ids-note
- Whole chapter: https://www.bctengineer.com/md/semester_7/computer_networks_and_security/chapter-8

## Question

Write a short note on IDS.

## Short answer

An IDS monitors network traffic or host activity for malicious behavior and alerts administrators but does not block traffic. Types include NIDS (network-based, e.g., Snort) and HIDS (host-based, e.g., OSSEC). Detection methods are signature-based (matches known patterns, low false positives) and anomaly-based (detects deviations from normal, higher false positives). IDS complements firewalls by detecting attacks that bypass rule-based filtering.

## Answer

An **IDS (Intrusion Detection System)** is a hardware or software system that monitors network traffic or host activity for malicious behaviour or policy violations and **raises an alert** to the administrator. It detects but does not by itself block; an **IPS (Intrusion Prevention System)** is placed in line and can also drop the offending traffic.

#### Types by location
- **NIDS (Network-based):** sensors on a network segment (switch mirror port) inspect packets, e.g. Snort, Suricata.
- **HIDS (Host-based):** software on a host watches system logs, file changes and processes, e.g. OSSEC, Tripwire.

#### Detection methods
| Method | Idea | Pro | Con |
|---|---|---|---|
| Signature-based (misuse) | Compares traffic with a database of known attack patterns | Few false alarms | Cannot detect new attacks |
| Anomaly-based | Learns normal behaviour; flags deviations | Detects unknown attacks | More false positives |

```text
Internet --[Firewall]--+-- LAN
                       |
                    [ NIDS ] -> Alert / log -> Admin
```

#### Role
IDS works together with firewalls: the firewall blocks according to rules, and the IDS spots attacks that pass through (port scans, DoS, buffer overflow, malware), and it supports logging and forensics.

## Check yourself

The answer's key points as multiple-choice questions, with the correct option and why.

1. Difference between IDS and IPS?
   A. IPS only alerts
   B. IDS drops traffic
   C. Same
   D. IDS alerts; IPS is in line and can drop traffic
   Answer: D. IDS detects but does not block by itself. (Key point: IDS vs IPS)

2. HIDS monitors:
   A. Network segment packets
   B. DNS
   C. Firewall rules
   D. Host logs, file changes and processes
   Answer: D. NIDS uses sensors on a segment. (Key point: NIDS vs HIDS)

3. Signature-based detection:
   A. Many false positives
   B. Few false alarms but cannot detect new attacks
   C. Detects unknown attacks
   D. Learns normal behaviour
   Answer: B. Anomaly-based is the opposite. (Key point: Signature-based)

4. Anomaly-based detection:
   A. Uses pattern database
   B. Needs no learning
   C. Blocks traffic
   D. Learns normal behaviour, flags deviations; more false positives
   Answer: D. It detects unknown attacks. (Key point: Anomaly-based)