IDS – Intrusion Detection System | IDS types | IDS Configuration | IDS protection types | Sniff

An intrusion detection system (IDS) is a device or software application that monitors a network or systems for malicious activity or policy violations. Any detected activity or violation is typically reported to an administrator or collected centrally using a SIEM (Security Information and Event Management) system. A SIEM system combines the output of multiple sources and uses alarm filtering techniques to distinguish malicious activity from false alarms.

There is a broad spectrum of IDS, ranging from antivirus software to hierarchical systems that monitor the traffic of an entire backbone network. The most common classifications are network intrusion detection systems (NIDS) and host-based intrusion detection systems (HIDS). ). A system that monitors important operating system files is an example of a HIDS, while a system that analyzes incoming network traffic is an example of a NIDS. It is also possible to classify IDS based on detection approach: the best known variants are signature-based detection (recognizing bad patterns, such as malware) and anomaly-based detection (detecting deviations from a model of /"good/ traffic, which often relies on machine learning). Some IDS have the ability to respond to detected intrusions. Systems with response capabilities are commonly referred to as an intrusion prevention system
-firewall, based on ID signature

Please take the opportunity to connect and share this video with your friends and family if you find it useful.