Intrusion detection system

An intrusion detection system monitors network traffic or host activity for signs of malicious behavior or policy violations, then reports suspected incidents.

Signature-based detection: A detection method that identifies activity matching known patterns of malicious behavior. It finds attacks whose recognizable patterns have already been encoded in the system.
Security information and event management: Software that collects and analyzes security events from multiple sources to support monitoring and incident response. It aggregates alerts and logs from intrusion detection systems alongside other security data.
Intrusion detection system evasion: Techniques attackers use to avoid detection or disguise malicious activity from intrusion detection systems. Attackers adapt their behavior to bypass the monitoring and detection methods deployed.
False positive: A test result that incorrectly indicates a condition is present when it is absent. Benign activity misclassified as an attack creates alerts analysts must investigate.
Anomaly detection: A method that flags observations that differ significantly from an established model of normal behavior. It can surface novel attacks by identifying departures from expected activity.
Security log: A chronological record of events generated by a computer system, application, or network device. Logs provide evidence that host-based detection systems analyze.
Deep packet inspection: Analysis of network packet contents beyond basic header information, often for security or traffic management. Some network detection systems inspect payloads to identify attack signatures.
False negative: A test result that incorrectly indicates a condition is absent when it is present. A missed intrusion exposes the central risk of incomplete detection.
Network packet analyzer: A tool that captures and examines network packets to inspect communications and diagnose traffic behavior. Network-based sensors inspect packets for suspicious content and connections.
Network intrusion detection system: An intrusion detection system that examines network traffic for suspicious activity or policy violations. It is the network-monitoring form of the broader system.

Linked from 7 pages