An intrusion detection system (IDS) watches network traffic or host activity and raises an alert when something looks like an attack. It detects and reports; an intrusion prevention system (IPS) can also block. Detection quality depends on the method used and on tuning, which is where most deployments succeed or fail.
What are the four kinds of IDS?
NIST SP 800-94 covers four classes of intrusion detection and prevention systems. Network-based systems watch traffic at chosen points on the network. Wireless systems watch wireless traffic. Network behavior analysis systems look for unusual traffic flows, such as denial of service. Host-based systems sit on one machine and watch its logs, files and activity.
The choice is about visibility. A network sensor sees every host on its segment but cannot read encrypted payloads. A host agent sees decrypted activity but only for that machine.
How does signature-based detection work?
A signature is a pattern that matches a known threat. The system compares each packet or log entry to a list of signatures. NIST gives a plain example: an email attachment named freepics.exe matches a known malware signature, but if the attacker renames it freepics2.exe, the signature no longer matches.
That is the whole tradeoff. Signatures are simple, fast and very good against known threats. They are largely ineffective against new threats, evasion and variants. They also have little understanding of protocols, so they struggle with attacks spread across several events where no single event looks bad.
What does anomaly-based detection add?
Anomaly-based systems learn a profile of normal behavior over time, then alert on significant deviations. A profile might say web traffic is usually a given share of border bandwidth during working hours, or that a user sends a typical number of emails per hour.
Its strength is catching unknown threats, because it does not need a prior description of the attack. Its weakness is noise. Normal behavior changes, and a profile built during a quiet month will flag a busy one.
And stateful protocol analysis?
The third method compares observed activity against what the protocol specification says should happen, and it tracks request and response pairs. It can notice that a session never authenticated before issuing commands. NIST notes most products combine more than one methodology for broader and more accurate detection.
Why does tuning matter so much?
NIST defines a false positive as benign activity flagged as malicious, and a false negative as a real attack missed. It states that it is not possible to eliminate all of either, and that reducing one often raises the other. Adjusting a system to improve accuracy is called tuning.
Consider a constructed case. A team deploys a network sensor with default rules. It fires 4,000 alerts on day one, most about a backup job that scans ports. Analysts start closing alerts unread. Three weeks later, a genuine credential-guessing run sits in the same queue and no one opens it. The tool worked. The process around it did not.
Where does it fit with logs and a SIEM?
NIST places log correlation tools, including security information and event management software, beside IDPS as complementary technology. An IDS produces alerts and events. A SIEM collects them with other logs so analysts can correlate across sources.
How to check or apply this
- Decide what you want to see: east-west traffic, internet edge, a handful of critical servers, or all three. Place sensors accordingly.
- Start in detect-only mode. Move rules to blocking only after you have watched their alerts for a while.
- Document the owner of every alert category and the first action expected.
- Tune weekly at first. Suppress alerts that are known benign, with a written reason and an expiry date.
- Keep signatures current and record the update date on each sensor.
- Test detection with a harmless, authorized exercise and confirm the alert actually reaches a person.
Quick check
Is an IDS the same as a firewall?
No. A firewall enforces which connections are allowed. An IDS observes traffic or hosts and alerts on suspicious activity. A firewall decides, an IDS reports.
Can an IDS see inside encrypted traffic?
A network sensor cannot read encrypted payloads without decryption at that point. A host-based system sees activity after decryption on that machine.
Sources
- NIST SP 800-94, Guide to Intrusion Detection and Prevention Systems (IDPS)
- NIST SP 800-94 publication page, including the planning note on retired Revision 1
Last reviewed: 18 October 2026.
