{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://cmaintz.github.io/tech-atlas/)"},"id":"security/intrusion-detection-system","url":{"en":"https://cmaintz.github.io/tech-atlas/en/terms/security/intrusion-detection-system/","da":"https://cmaintz.github.io/tech-atlas/da/terms/security/intrusion-detection-system/"},"term":{"en":"Intrusion detection system (IDS)","da":"Indtrængningsdetektion (IDS)"},"aka":{"en":["IDS"],"da":["IDS","system til indtrængningsdetektion"]},"domain":["security"],"cluster":"controls","layer":"network","status":"current","era":1987,"summary":{"en":"A watcher that inspects network traffic or a machine's activity and warns when it spots signs of an attack - without stopping it.","da":"En vagt, der holder øje med netværkstrafik eller en maskines aktivitet og advarer ved tegn på angreb - uden selv at stoppe det."},"body":{"formal":{"en":"A system that examines copies of network packets or activity on a host, compares them against known attack patterns or normal behaviour, and reports matches as alerts while leaving the traffic itself untouched.","da":"Et system, der undersøger kopier af netværkspakker eller aktivitet på en maskine, sammenligner dem med kendte angrebsmønstre eller normal adfærd og melder fund som alarmer, mens selve trafikken får lov at passere."},"plain":{"en":"Like a burglar alarm - it rings when someone breaks in, but it does not lock the door.","da":"Som en tyverialarm - den hyler, når nogen bryder ind, men den låser ikke døren."},"inPractice":{"en":"At a regional hospital, the IDS sees a PC in the finance office trying to reach hundreds of other machines within seconds and sends an alert to the SIEM, where the on-duty analyst decides what to do.","da":"På et regionshospital ser IDS'en en pc i økonomiafdelingen forsøge at kontakte hundredvis af andre maskiner på få sekunder og sender en alarm til SIEM'en, hvor den vagthavende analytiker beslutter, hvad der skal ske."},"whyItMatters":{"en":"Because it only watches, it can be placed almost anywhere without risk of blocking real work - but someone must act on its warnings, or they are worth nothing.","da":"Fordi den kun ser på, kan den placeres næsten overalt uden risiko for at blokere rigtigt arbejde - men nogen skal handle på advarslerne, ellers er de intet værd."}},"deepDive":{"en":"The conceptual basis for intrusion detection is Dorothy Denning's 1987 paper \"An Intrusion-Detection Model\" (IEEE Transactions on Software Engineering), which proposed profiling normal subject behaviour and flagging statistical deviations. NIST SP 800-94 (2007) still provides the standard taxonomy: network-based (NIDS), wireless, network behaviour analysis (flow-based) and host-based (HIDS) systems, using three detection methodologies - signature-based matching, anomaly-based detection against a baseline, and stateful protocol analysis that checks traffic against the expected behaviour of protocols such as HTTP, DNS or SMB.\n\nA NIDS receives a copy of traffic from a switch SPAN/mirror port or a network TAP, so it is passive and cannot add latency or drop packets - but it also cannot prevent anything, and mirrored ports silently drop frames under load. The best-known open-source engines are Snort (1998), Suricata (multi-threaded, maintained by the Open Information Security Foundation) and Zeek, formerly Bro, which is less a signature matcher than a protocol analyser producing rich connection, DNS, HTTP and TLS logs. Rule sets such as Emerging Threats or Snort's Talos rules match on header fields, byte content, protocol-parsed buffers and flow state. Host-based IDS (OSSEC, Wazuh, auditd-based tools) inspect logs, file integrity and system calls on the host itself and overlap heavily with EDR.\n\nClassic weaknesses are well documented. Ptacek and Newsham (1998) showed that differences in IP fragment and TCP segment reassembly between the sensor and the target let attackers insert or evade traffic; modern engines counter this with target-based reassembly policies. Encryption is the larger practical limit: with TLS 1.3 and encrypted SNI/ECH, a NIDS sees little beyond metadata unless traffic is decrypted at a proxy, so detection shifts to JA3/JA4-style fingerprints, certificate metadata, DNS and flow behaviour. Anomaly detection suffers from the base-rate fallacy described by Axelsson (1999): because genuine attacks are rare, even a very low false-positive rate produces far more false alarms than true ones, which is why tuning and alert triage dominate operating cost.\n\nAn IDS differs from an IPS in placement and authority - out of band and alert-only versus inline and blocking - and most modern products can run in either mode. Its output is only useful when forwarded to a SIEM or SOC that correlates and acts on it; CIS Controls v8 Control 13 (network monitoring and defense) and ISO/IEC 27002:2022 control 8.16 (monitoring activities) are the usual anchors.","da":"Det teoretiske grundlag for indtrængningsdetektion er Dorothy Dennings artikel \"An Intrusion-Detection Model\" fra 1987 (IEEE Transactions on Software Engineering), der foreslog at profilere subjekters normale adfærd og markere statistiske afvigelser. NIST SP 800-94 (2007) leverer stadig standardinddelingen: netværksbaserede (NIDS), trådløse, netværksadfærdsanalyse (flowbaseret) og værtsbaserede (HIDS) systemer, som bruger tre detektionsmetoder - signaturbaseret matchning, anomalibaseret detektion op mod en baseline og stateful protokolanalyse, der holder trafikken op mod den forventede adfærd for protokoller som HTTP, DNS eller SMB.\n\nEn NIDS får en kopi af trafikken fra en SPAN-/mirror-port på en switch eller fra en netværks-TAP, så den er passiv og hverken kan tilføje forsinkelse eller tabe pakker - men den kan heller ikke forhindre noget, og spejlede porte taber stille og roligt rammer under høj belastning. De mest kendte open source-motorer er Snort (1998), Suricata (flertrådet, vedligeholdt af Open Information Security Foundation) og Zeek, tidligere Bro, som mindre er en signaturmatcher end en protokolanalysator, der producerer detaljerede logs over forbindelser, DNS, HTTP og TLS. Regelsæt som Emerging Threats eller Snorts Talos-regler matcher på headerfelter, byteindhold, protokolparsede buffere og flowtilstand. Værtsbaserede IDS'er (OSSEC, Wazuh, auditd-baserede værktøjer) undersøger logs, filintegritet og systemkald på selve værten og overlapper meget med EDR.\n\nDe klassiske svagheder er veldokumenterede. Ptacek og Newsham (1998) viste, at forskelle i samling af IP-fragmenter og TCP-segmenter mellem sensor og mål lader angribere indsætte eller skjule trafik; moderne motorer modvirker det med målbaserede reassembly-politikker. Kryptering er den største praktiske begrænsning: med TLS 1.3 og krypteret SNI/ECH ser en NIDS kun lidt ud over metadata, medmindre trafikken dekrypteres i en proxy, så detektionen flytter over på JA3/JA4-fingeraftryk, certifikatmetadata, DNS og flowadfærd. Anomalidetektion lider under den base-rate-fejlslutning, Axelsson beskrev i 1999: fordi reelle angreb er sjældne, giver selv en meget lav falsk-positiv-rate langt flere falske end ægte alarmer, og derfor dominerer tuning og triage driftsomkostningerne.\n\nEn IDS adskiller sig fra en IPS i placering og beføjelser - uden for trafikvejen og kun alarmerende frem for inline og blokerende - og de fleste moderne produkter kan køre i begge tilstande. Outputtet er kun nyttigt, når det sendes videre til en SIEM eller SOC, der korrelerer og handler på det; CIS Controls v8 Control 13 (netværksovervågning og -forsvar) og ISO/IEC 27002:2022 kontrol 8.16 (overvågningsaktiviteter) er de sædvanlige ankre."},"edges":[{"type":"requires","to":"cs/network","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/packet","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/intrusion-prevention-system","why":{"en":"An IDS only watches and warns; an IPS sits in the path of traffic and blocks what it judges harmful.","da":"En IDS ser kun på og advarer; en IPS sidder i trafikkens vej og blokerer det, den vurderer som skadeligt."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/siem","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/security-monitoring","confidence":"high","strength":"normal"}],"depth":3,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-94 - Guide to Intrusion Detection and Prevention Systems (IDPS)","tier":"standard","publisher":"NIST"}],"draft":true}