Intrusion Detection System
An Intrusion Detection System (IDS) monitors network traffic or host activity to identify suspicious behaviour and policy violations, raising alerts without blocking the traffic itself.
What is Intrusion Detection System?
Definition
Intrusion Detection System (IDS) monitors network traffic or host activity to identify suspicious behaviour, known attack patterns and policy violations, and raises an alert when it finds them. Its defining limitation is deliberate: an IDS observes and reports, it does not block — that is the job of an IPS, which sits in line with the traffic and can drop it. Deployments split into network-based (NIDS), watching traffic at a chosen point, and host-based (HIDS), watching what happens on one system; in cybersecurity operations the two answer different questions and are frequently run together.
Role in cybersecurity
Intrusion Detection System plays an important role in building organizational resilience against cyber threats. Implementing appropriate mechanisms in this area is required by regulations such as NIS2, DORA and ISO 27001.