Intrusion detection systems: how IDS and IPS work, and where they fit now
An intrusion detection system watches traffic or hosts for signs of attack. It's an old idea that still catches what endpoint tools miss, especially on devices that can't run an agent.
An intrusion detection system (IDS) monitors network traffic or system activity and raises alerts when it sees signs of an attack. An intrusion prevention system (IPS) does the same and can also block the traffic. Together they are often called IDPS.
The four types
NIST's guide to the technology, SP 800-94, describes four classes of IDPS:
| Type | What it watches | Typical use |
|---|---|---|
| Network-based | Traffic on network segments | Spotting attacks crossing the network, at the edge or between segments |
| Wireless | Wireless network traffic | Detecting rogue access points and wireless attacks |
| Network behavior analysis | Traffic patterns and flows | Finding unusual volumes, scanning and data leaving the network |
| Host-based | Activity on a single server or device | Detecting changes to files, logs and processes |
How detection works
Signature-based detection matches traffic against known attack patterns. It is precise for known threats and blind to new ones. Anomaly-based detection learns normal behavior and flags departures from it, which can catch new attacks but produces more false alarms. Most products combine the two.
Open source options
Suricata and Snort are widely used open source network IDS and IPS engines that use signature rules. Zeek takes a different approach: it records detailed logs of network activity, such as connections, DNS queries and file transfers, which help a great deal in investigations. Many commercial network detection and response (NDR) products build on these engines.
Where IDS fits today
Endpoint detection and response (EDR) now covers most laptops and servers. Network-based detection still matters for three reasons. Many devices can't run an EDR agent, including printers, phones, cameras and operational technology. Attackers often disable endpoint agents. And network traffic shows movement between systems that a single host doesn't see.
Next-generation firewalls include IPS features, which cover the network edge. Internal traffic between segments is where many networks have no detection at all.
Making it useful
An IDS produces value only if someone acts on its alerts. Send alerts to your SIEM, tune out noisy rules, and focus first on high-confidence signatures and on traffic to and from your most important systems. See our SIEM explainer for the logging side.
What IT teams should do
- Check whether you have any detection on internal traffic between network segments.
- Turn on IPS features in your edge firewalls and keep signatures updated.
- Put network monitoring on segments with devices that can't run EDR.
- Send IDS alerts to your SIEM and review the noisiest rules monthly.