What is IDS?

IDS (Intrusion Detection System) is an intrusion detection system that monitors network activity or system events and identifies suspicious actions.

In simple terms: IDS is an "alarm system" that notices an attack and reports it, but does not block anything itself.

---

#Why IDS is needed

IDS is needed to:

• detect attacks and intrusion attempts;
• identify suspicious behavior;
• notify administrators in time;
• complement a firewall and other defenses.

A firewall blocks based on rules, while IDS analyzes and detects threats.

---

#How IDS works

IDS:

1. analyzes network traffic or system events;
2. compares them with known attack patterns or normal behavior;
3. creates an alert when a threat is detected.

Important: IDS does not stop an attack automatically, it only reports it.

---

#Main types of IDS

#1. NIDS (Network IDS)

A network intrusion detection system

• analyzes network traffic;
• is installed at key points in the network;
• detects attacks at the network level.

Example attacks:

• port scanning;
• DoS;
• MITM;
• suspicious traffic.

---

#2. HIDS (Host IDS)

A host intrusion detection system

• runs on a specific server or computer;
• analyzes logs, processes, files;
• detects changes in the system.

Useful for detecting:

• unauthorized file changes;
• malicious processes;
• server compromise.

---

#Attack detection methods

#1. Signature-based

• comparison with known attack patterns;
• effective against known threats.

Downside: it does not see new (unknown) attacks.

---

#2. Anomaly-based

• analysis of deviations from normal behavior;
• can detect new attacks.

Downside: false positives are possible.

---

#What IDS violates

IDS does not directly violate anything, but it helps detect attacks that threaten:

• confidentiality;
• integrity;
• availability.

---

#Limitations of IDS

It is important to understand:

• IDS does not block attacks;
• it requires alert analysis;
• it can generate false positives.

That is why IDS is usually used together with a firewall and IPS.