Intrusion Detection

Intrusion Detection can be either a hardware device or software application that monitors, incoming and outbound, for any malicious activity and policy violation.

In other words, it is a software application that scans a network or a system for a harmful activity or policy breaching. Any malicious venture or violation is normally reported either to an administrator or collected centrally using a security information and event management (SIEM) system. A SIEM system integrates outputs from multiple sources and uses alarm filtering techniques to differentiate malicious activity from false alarms.

Although intrusion detection systems monitor networks for potentially malicious activity, they are also disposed to false alarms. Hence, organizations need to fine-tune their IDS products when they first install them. It means properly setting up the intrusion detection systems to recognize what normal traffic on the network looks like as compared to malicious activity.  

Intrusion Detection System is of 5 types;-

1. Network Intrusion Detection System (NIDS)
2. Host Intrusion Detection System (HIDS)
3. Protocol-based Intrusion Detection System (PIDS)
4. Application Protocol-based Intrusion Detection System (APIDS)
5. Hybrid Intrusion Detection System(HIDS) 

Intrusion Prevention System

An Intrusion Prevention System(IPS) is like a steroid on IDS. Not only it can detect the same kind of malicious activity and security policy violation but it can execute real-time response to stop an immediate threat to your network. Like an IDS, the IPS can be NIPS based with sensors at various points of networks or HIPS-based with sensors on the host to monitor individual devices. IPS has the ability to configure based policy, rules, and actions to be executed when an anomaly is detected.