An intrusion detection system (IDS) monitors network traffic or system events and raises an alert when activity looks like an attempt to get unauthorized access. It does not block by itself. An intrusion prevention system adds the ability to stop the activity. Most products do both, so NIST calls them IDPS.
What does NIST say an IDS is?
NIST's glossary defines an intrusion detection system as a security service that monitors and analyzes network or system events to find, and give real-time or near real-time warning of, attempts to access system resources in an unauthorized manner. SP 800-94, the main NIST guide, covers four classes of IDPS: network-based, wireless, network behavior analysis and host-based.
Network-based sensors watch traffic at chosen points. Wireless ones watch wireless traffic. Network behavior analysis looks at flows to find unusual patterns, such as floods or policy violations. Host-based agents sit on one machine and watch its logs, files and processes. The guide also notes that security information and event management software is a complementary technology.
How does it decide something is an attack?
SP 800-94 describes three methods.
Signature-based detection compares activity to patterns of known threats. NIST calls it very effective against known threats and largely ineffective against unknown ones, evasion techniques and many variants. Its example: a signature looking for a file named freepics.exe misses the same malware renamed freepics2.exe. It is also simple, so it cannot follow multi-step attacks where no single event looks bad.
Anomaly-based detection builds profiles of normal behavior for users, hosts, connections or applications, then flags significant deviations. Its strength is catching previously unknown threats. The cost is false positives when normal behavior changes, and a profile must be built from a period of typical activity.
Stateful protocol analysis compares activity against vendor-developed profiles of how a protocol should behave, and can follow request and response pairs.
Most real products blend these. Ask a vendor which they use for which traffic.
Where should you put sensors?
A constructed example: a company puts one network sensor at the internet edge and gets alerts about scans from outside. Six months later, malware spreads between two internal servers. The sensor never sees it, because that traffic never crosses the edge.
Place sensors where traffic you care about crosses a boundary: between users and servers, between server tiers, near the data center core, and at cloud virtual network mirror points where available. Pair them with host agents on critical servers, which see activity that network sensors cannot, such as local processes and encrypted traffic after decryption on the host.
What makes an IDS useful or useless?
Alert volume. An IDS that fires a thousand low-value alerts a day teaches the team to ignore it. Tune on purpose. Turn off rules for services you do not run. Raise thresholds on noisy checks. Map each alert type to an owner and a response step. If nobody owns an alert type, delete it or fix the gap.
Also check what the IDS cannot see. Encrypted traffic hides payloads from network sensors unless it is decrypted, and that has its own risks.
How to check or apply this
- Write down what you want to detect: scanning, malware command traffic, policy violations, suspicious logins.
- Choose sensor types to match: network for boundaries, host for critical systems, wireless if you run it.
- Place sensors at boundaries that matter. Draw the map and mark blind spots.
- Start in detection mode. Read alerts for two weeks before turning on any blocking.
- Tune noisy rules. Record every change with a reason.
- Assign an owner and response step to each alert type.
- Test by running a harmless, authorized scan or test event, and confirm an alert reaches a person.
Quick check
What is the difference between an IDS and an IPS?
An IDS detects and alerts. An IPS can also act to stop the activity. NIST's guide covers both together as IDPS.
Why do signature-based systems miss some attacks?
They only match known patterns. A small change to a known threat, or a threat nobody has described yet, may not match any signature.
Sources
- NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)
- NIST CSRC Glossary, intrusion detection system
Last reviewed: 18 October 2026.
