What is Intrusion Detection?

What is Intrusion Detection?

Intrusion detection is the art and science of sensing when a system or network is being used inappropriately or without authorization. An intrusion-detection system (IDS) monitors system and network resources and activities and, using information gathered from these sources, notifies the authorities when it identifies a possible intrusion. 

ntrusion detection systems can also be categorized as knowledge- or behavior-based. Most commercially available systems are knowledge-based, matching signatures of known attacks against changes in systems or streams of packets on a network. Such systems are reliable and generate few false positives, but they can detect intruders using only attacks they already know about. They're often helpless against new attacks, so they must be continually updated with new knowledge about new attacks.

A behavior-based IDS instead looks at actions, attempting to identify attacks by monitoring system or network activity and flagging any activity that doesn't seem to fit in. Such activities may trigger an alarm - often a false alarm. Though false positives are common with a behavior-based on IDS, so is the ability to detect a previously unreported attack.