Intrusion detection

What it means

Intrusion detection is the practice of watching network traffic or activity on machines for signs that someone is breaking in or misusing a system. A system that does this is an IDS. It compares what it sees with known attack patterns, or with what normal looks like, and raises an alert when something does not fit.

There are two kinds. A network IDS inspects traffic passing a point on the network. A host IDS watches one machine, such as its files, logs and processes. An intrusion prevention system, or IPS, goes further and blocks what it flags, instead of only reporting it.

Why it matters

Prevention fails sometimes, so detection decides how long an intruder stays unnoticed. The sooner you see unusual activity, the less data can be taken and the cheaper the clean-up. Auditors and customers often expect detection capability under frameworks such as PCI DSS and ISO 27001.

It also feeds your response. Alerts show which system, what pattern and when, which gives an incident response team a place to start. Without any, the first sign of a break-in is often a customer, a regulator or a ransom note.

How it shows up

It shows up as sensors on a network segment or cloud traffic mirror, agents on servers, rules for known attack signatures and models for unusual behaviour. Alerts normally flow into a SIEM for correlation and review. Encrypted traffic limits what a network sensor can read, which is one reason host-based tools matter.

The common failures are signatures that miss new attacks, anomaly rules that flood the team with noise, see alert fatigue, sensors placed where they see nothing useful, and no one assigned to respond. An IDS is also poor at spotting business-logic abuse, such as one account reading another's records through a normal-looking request. NIST SP 800-94 is the standard guide.