Suggest an editImprove this articleRefine the answer for “What is IDS?”. Your changes go to moderation before they’re published.Approval requiredContentWhat you’re changing🇺🇸EN🇺🇦UAPreviewTitle (EN)Short answer (EN)**IDS (Intrusion Detection System)** monitors network activity or system events and identifies suspicious actions. **Key point:** IDS does not block an attack automatically, it only reports it, which is why it is usually used together with a firewall and IPS.Shown above the full answer for quick recall.Answer (EN)Image**IDS (Intrusion Detection System)** is an **intrusion detection system** that **monitors network activity or system events and identifies suspicious actions**. In simple terms: *IDS is an "alarm system" that notices an attack and reports it, but does not block anything itself.* --- ## Why IDS is needed IDS is needed to: - detect attacks and intrusion attempts; - identify suspicious behavior; - notify administrators in time; - complement a firewall and other defenses. A firewall **blocks based on rules**, while IDS **analyzes and detects threats**. --- ## How IDS works IDS: 1. analyzes network traffic or system events; 2. compares them with known attack patterns or normal behavior; 3. **creates an alert** when a threat is detected. Important: IDS **does not stop an attack automatically**, it only reports it. --- ## Main types of IDS ### 1. NIDS (Network IDS) **A network intrusion detection system** - analyzes **network traffic**; - is installed at key points in the network; - detects attacks at the network level. Example attacks: - port scanning; - DoS; - MITM; - suspicious traffic. --- ### 2. HIDS (Host IDS) **A host intrusion detection system** - runs on a specific server or computer; - analyzes logs, processes, files; - detects changes in the system. Useful for detecting: - unauthorized file changes; - malicious processes; - server compromise. --- ## Attack detection methods ### 1. Signature-based - comparison with known attack patterns; - effective against known threats. Downside: it does not see new (unknown) attacks. --- ### 2. Anomaly-based - analysis of deviations from normal behavior; - can detect new attacks. Downside: false positives are possible. --- ## What IDS violates IDS does not directly violate anything, but it **helps detect attacks** that threaten: - confidentiality; - integrity; - availability. --- ## Limitations of IDS It is important to understand: - IDS does not block attacks; - it requires alert analysis; - it can generate false positives. That is why IDS is usually used **together with a firewall and IPS**.For the reviewerNote to the moderator (optional)Visible only to the moderator. Helps review go faster.