What is Intrusion detection system (IDS)?

A system that monitors network traffic or activity on endpoints, finds suspected attacks and alerts administrators. There are signature-based systems, which compare against the characteristics of known attacks, and anomaly-based systems, which look for deviations from normal behavior. A system placed in the traffic path (inline) that can block traffic judged to be an attack on the spot is called an IPS (intrusion prevention system). Because an IPS may stop legitimate traffic through false positives, its blocking rules are tuned carefully.

Japanese name: 侵入検知システム(IDS)

Intrusion detection system (IDS) appears in 3 practice questions across 1 topic, including Cyber Attacks and Defense in Practice.

Field: Cyber Attacks and Defense in Practice

Try it: questions about Intrusion detection system (IDS)

Which of the following correctly describes the difference between an IDS (intrusion detection system) and an IPS (intrusion prevention system)?

AAn IDS automatically blocks malicious traffic when it finds it, while an IPS only records traffic for later analysis and does not block it
BAn IDS detects suspected attacks and notifies administrators, while an IPS sits in the traffic path and blocks traffic it judges to be malicious
CBoth an IDS and an IPS are mechanisms that automatically distribute and apply programs fixing software vulnerabilities to each internal device

Show answer and explanation

Answer: B. An IDS detects suspected attacks and notifies administrators, while an IPS sits in the traffic path and blocks traffic it judges to be malicious

An IDS monitors network traffic (or activity on endpoints) and raises an alert when it finds a suspected attack. It is often deployed to receive and examine a copy of the traffic, so misjudging normal traffic as an attack does not stop business, but blocking is left to people or other mechanisms. An IPS sits in the traffic path (inline) and can block traffic it judges to be an attack on the spot. In exchange, false positives stop legitimate business traffic, and device failures or processing delays affect all traffic, so the rules used for blocking are tuned carefully.

Which of the following correctly compares signature-based (misuse) detection and anomaly-based detection as IDS detection methods?

ASignature-based detection matches known attack characteristics and tends to miss unknown attacks; anomaly-based detection finds deviations from normal and can notice unknown attacks but produces more false positives
BSignature-based detection reliably detects even unknown attacks that are not registered, while anomaly-based detection can only detect known attacks registered in advance
CAnomaly-based detection does not need to learn the normal state, so it can be used without false positives right after deployment, and no signature updates are needed

Show answer and explanation

Answer: A. Signature-based detection matches known attack characteristics and tends to miss unknown attacks; anomaly-based detection finds deviations from normal and can notice unknown attacks but produces more false positives

Signature-based detection registers the traffic characteristics (signatures) of known attacks in advance and detects whatever matches. It finds registered attacks accurately but tends to miss new attacks or attacks with slightly altered characteristics, and the signatures must be updated constantly. Anomaly-based detection learns the normal state (baseline), such as traffic volume, time of day and destinations, and detects large deviations from it, so it may notice unknown attacks. On the other hand, it tends to judge legitimate but rare traffic as abnormal, increasing false positives, so in practice the two are combined.

Intrusion detection system (IDS) in the explanations

An IDS monitors network traffic (or activity on endpoints) and raises an alert when it finds a suspected attack.
Which of the following correctly describes the difference b…