침입 탐지 시스템 (IDS)

IDS vs. IPS

An Intrusion Detection System (IDS) monitors network traffic or host activity and generates alerts when it identifies suspicious patterns. It is passive — it observes and reports, but does not block traffic. An Intrusion Prevention System (IPS) sits inline in the traffic path and can actively block or modify traffic in real time. Modern deployments often combine both in IDPS (Intrusion Detection and Prevention System) platforms.

Network IDS (NIDS) monitors traffic at strategic chokepoints — typically at FirewallA network security device or software that monitors and filters incoming and outgoing traffic based on predefined rules. Firewalls can block traffic by IP address, port number, protocol, or application-layer content. egress — and analyzes packet headers and payloads. Host IDS (HIDS) runs on individual servers, monitoring system calls, file integrity, and local log files for signs of compromise.

Detection Methods

Signature-based detection compares traffic against a database of known attack patterns (similar to antivirus). It is highly effective against known threats but blind to novel attacks. Anomaly-based detection establishes a baseline of normal behavior and alerts on deviations — effective against zero-day attacks but prone to false positives during unusual but legitimate activity spikes.

Real-World Deployment

IDS generates substantial alert volume in any real network. Security Operations Centers (SOCs) use SIEM platforms to correlate IDS alerts with other data sources and reduce false-positive noise. Tuning detection thresholds and maintaining current signature databases are ongoing operational requirements.

IDS complements FirewallA network security device or software that monitors and filters incoming and outgoing traffic based on predefined rules. Firewalls can block traffic by IP address, port number, protocol, or application-layer content. controls: the firewall enforces access policy, while IDS monitors permitted traffic for malicious behavior. Understanding DDoSDistributed Denial of Service. An attack that overwhelms a target server or network with massive traffic from many compromised sources (a botnet), rendering the service unavailable to legitimate users. attack traffic patterns is important context for configuring IDS thresholds to avoid flooding analysts with volumetric attack alerts.