An intrusion detection system (IDS) is a device or software application that monitors a network for malicious activity or policy violations. Any malicious activity or violation is typically reported or collected centrally using a security information and event management system. Some IDS’s are capable of responding to detected intrusion upon discovery. These are classified as intrusion prevention systems (IPS).
When placed at a strategic point or points within a network to monitor traffic to and
from all devices on the network, an IDS will perform an analysis of passing traffic, and
match the traffic that is passed on the subnets to the library of known attacks. Once an
attack is identified, or abnormal behavior is sensed, the alert can be sent to the administrator.