What Is IDS and IPS? Intrusion Detection and Prevention Systems Explained

IDS detects attacks; IPS blocks them. Learn the difference between network-based and host-based systems, how signature and anomaly detection work, and where IDS/IPS fits in your security stack.

What Are IDS and IPS?

An Intrusion Detection System (IDS) monitors network traffic or system activity and generates alerts when it detects suspicious or malicious behaviour. It is passive — it watches and reports, but does not intervene.

An Intrusion Prevention System (IPS) goes further: it monitors traffic and automatically blocks or drops malicious traffic in real time. It is active — it can prevent attacks as they happen.

IDS: Traffic flows normally
[Network traffic] ──────────────────────────> [Servers]
                       ↓ (copy)
                   [IDS sensor]
                   [Alert generated] ──────> [SIEM / analyst]

IPS: Traffic is inspected inline
[Network traffic] ──> [IPS] ──────────────> [Servers]
                        ↓ (block malicious traffic)
                   [Alert generated] ──────> [SIEM / analyst]

Network-Based vs Host-Based

NIDS / NIPS (Network-Based)

Monitors traffic at the network level — typically placed at the network perimeter (next to the firewall) or at key internal chokepoints.

  • Advantages: Sees all traffic, single deployment point, difficult for attacker to disable
  • Limitations: Cannot inspect encrypted traffic (without TLS inspection), cannot detect attacks that stay within a single host, high traffic environments challenge real-time analysis

HIDS / HIPS (Host-Based)

Runs as an agent on the endpoint (server or workstation) and monitors system logs, file system changes, running processes, and network connections on that specific host.

  • Advantages: Can inspect encrypted traffic after decryption, detects insider threats, sees host-level events
  • Limitations: Agent must be installed on each system, consumes endpoint resources, harder to manage at scale

Most organisations deploy both: NIDS/NIPS at network boundaries and HIDS/HIPS on critical servers.

Detection Methods

1. Signature-Based Detection

Compares network traffic or activity against a database of known attack signatures — patterns that uniquely identify known threats.

Rule example (Snort):
alert tcp any any -> $HOME_NET 22 (msg:"SSH brute force";   threshold: type both, track by_src, count 5, seconds 60;   sid:100001;)

Advantages: Very accurate for known threats, low false positives, fast

Limitations:

  • Cannot detect zero-day attacks (no signature exists yet)
  • Signatures must be continuously updated
  • Attackers can modify known exploits to evade signatures

2. Anomaly-Based Detection

Establishes a baseline of normal behaviour, then raises alerts when observed behaviour deviates significantly from the baseline.

For example: a web server normally receives 1,000 requests/minute from diverse IPs. If it suddenly receives 100,000 requests/minute from a single IP, the anomaly detector fires.

Advantages: Can detect previously unknown attacks (zero-days), detects insider threats that show unusual behaviour

Limitations: Higher false positive rate — unusual but legitimate activity generates alerts, requires time to establish accurate baselines

3. Policy-Based Detection

Alerts on violations of explicitly defined rules — for example, any traffic to a prohibited port-the-internets-core-protocol)-and-UDP-ports-explained), any outbound connection to a known C2 IP, or any process spawning a shell.

4. Reputation-Based Detection

Compares source IPs against threat intelligence-security-operations-centre-SIEM-incident-response-explained) feeds of known malicious addresses — botnet C2 servers, Tor exit nodes, known scanners.

Common IDS/IPS Tools

| Tool | Type | License | Notes | |---|---|---|---| | Snort | NIDS/NIPS | Open source | Industry standard, large rule community | | Suricata | NIDS/NIPS | Open source | Multi-threaded, high performance | | Zeek (Bro) | NIDS | Open source | protocol analysis, scripting language | | OSSEC | HIDS | Open source | Log analysis, file integrity monitoring | | Wazuh | HIDS/SIEM | Open source | Extended OSSEC with SIEM-security-operations-centre-siem-incident-response-explained) capabilities | | CrowdStrike Falcon | HIPS/EDR | Commercial | Cloud-managed [endpoint detection-security-operations-centre-SIEM-incident-response-explained) and response](/learning-center/what-is-a-soc-security-operations-centre-siem-incident-response-explained) |

IDS/IPS and False Positives

A false positive occurs when a legitimate activity is flagged as an attack. A false negative occurs when a real attack is not detected.

| | Detected as Attack | Not Detected | |---|---|---| | Is an attack | True Positive ✅ | False Negative ❌ | | Is not an attack | False Positive ⚠️ | True Negative ✅ |

High false positive rates cause alert fatigue — security teams see so many alerts that they begin ignoring them, eventually missing real attacks. Tuning IDS/IPS rules to the specific environment is critical.

IDS vs Firewall vs WAF

| | firewall | IDS/IPS | WAF | |---|---|---|---| | Focus | Allow/deny by IP/port | Detect attack patterns in traffic | HTTP attacks | | Layer | L3/L4 | L3-L7 | L7 | | Action | Block/allow | Alert/block | Block | | State | Stateful | Pattern/anomaly | HTTP signatures | | Position | Network perimeter | Inline or passive | Front of web apps |

These tools are complementary — a complete security stack includes all three.

IDS/IPS in a Security Stack

IDS/IPS generates alerts that feed into a SIEM-security-operations-centre-siem-incident-response-explained) (Security Information and Event Management) system. The SIEM correlates alerts from IDS/IPS, firewalls, servers, and endpoints to give security analysts a comprehensive picture of what is happening across the environment.

EDR ([endpoint detection-security-operations-centre-SIEM-incident-response-explained) and response](/learning-center/what-is-a-soc-security-operations-centre-siem-incident-response-explained)) is the modern evolution of HIPS — it not only detects and blocks threats but also records detailed telemetry about what happened, enabling forensic investigation.

Summary

  • IDS detects and alerts; IPS detects, alerts, and blocks in real time
  • Network-based systems see all traffic; host-based systems see endpoint-level detail
  • Signature detection finds known threats; anomaly detection can find unknown threats
  • False positives cause alert fatigue — tuning and contextual correlation are essential
  • IDS/IPS feeds into a SIEM-security-operations-centre-siem-incident-response-explained) for event correlation and analyst review
  • Modern organisations combine NIDS/NIPS at the network with EDR on endpoints