Intrusion detection system (IDS)

The conceptual basis for intrusion detection is Dorothy Denning's 1987 paper "An Intrusion-Detection Model" (IEEE Transactions on Software Engineering), which proposed profiling normal subject behaviour and flagging statistical deviations. NIST SP 800-94 (2007) still provides the standard taxonomy: network-based (NIDS), wireless, network behaviour analysis (flow-based) and host-based (HIDS) systems, using three detection methodologies - signature-based matching, anomaly-based detection against a baseline, and stateful protocol analysis that checks traffic against the expected behaviour of protocols such as HTTP, DNS or SMB.

A NIDS receives a copy of traffic from a switch SPAN/mirror port or a network TAP, so it is passive and cannot add latency or drop packets - but it also cannot prevent anything, and mirrored ports silently drop frames under load. The best-known open-source engines are Snort (1998), Suricata (multi-threaded, maintained by the Open Information Security Foundation) and Zeek, formerly Bro, which is less a signature matcher than a protocol analyser producing rich connection, DNS, HTTP and TLS logs. Rule sets such as Emerging Threats or Snort's Talos rules match on header fields, byte content, protocol-parsed buffers and flow state. Host-based IDS (OSSEC, Wazuh, auditd-based tools) inspect logs, file integrity and system calls on the host itself and overlap heavily with EDR.

Classic weaknesses are well documented. Ptacek and Newsham (1998) showed that differences in IP fragment and TCP segment reassembly between the sensor and the target let attackers insert or evade traffic; modern engines counter this with target-based reassembly policies. Encryption is the larger practical limit: with TLS 1.3 and encrypted SNI/ECH, a NIDS sees little beyond metadata unless traffic is decrypted at a proxy, so detection shifts to JA3/JA4-style fingerprints, certificate metadata, DNS and flow behaviour. Anomaly detection suffers from the base-rate fallacy described by Axelsson (1999): because genuine attacks are rare, even a very low false-positive rate produces far more false alarms than true ones, which is why tuning and alert triage dominate operating cost.

An IDS differs from an IPS in placement and authority - out of band and alert-only versus inline and blocking - and most modern products can run in either mode. Its output is only useful when forwarded to a SIEM or SOC that correlates and acts on it; CIS Controls v8 Control 13 (network monitoring and defense) and ISO/IEC 27002:2022 control 8.16 (monitoring activities) are the usual anchors.