Intrusion Detection Systems (IDS) Types: The Complete Guide

More proprietary and sensitive information have become available online than ever before. This has led to a corresponding increase in the number of cybercriminals trying to get hold of this valuable information. 

If a malicious attacker successfully penetrates your network, it can lead to several potential losses, including downtime, data breaches, and loss of customer trust. Luckily, using intrusion detection systems (IDS) types can help you safeguard your network and on-premise devices.

What Is an Intrusion Detection System (IDS)?

An intrusion detection system (IDS) is a hardware device or software app that monitors inbound and outbound network traffic to detect vulnerability exploits, policy violations, and malicious activity. 

The system places sensors or network devices like servers, firewalls, and routers to analyze traffic activity continuously and detect abnormal changes in patterns. In case it detects unusual behavior, the IDS will notify administrators immediately. The administrator can then review alarms and take action to eliminate threats right away.

In a nutshell, an IDS can:

• Monitor online user behavior
• Recognize attack patterns within network packets
• Detect abnormal traffic activity and raise notifications 
• Ensure user and system activity compliance with security policies

For example, you can use the IDS to analyze data carried by traffic networks to detect known malware or other malicious content. If the system does detect this type of threat, it’ll automatically notify your security team, who can then investigate and remediate to prevent the attack from taking over the system.

Alternatively, you can also set up the system to report such threats to a security information and event management (SIEM) system.

How an Intrusion Detection System Works

An intrusion detection system allows you to catch malicious agents before they can do any real damage to your network by detecting anomalies promptly and effectively. 

It monitors online traffic to and from all devices on the network and quietly operates behind a firewall as a secondary filter for malicious network packets. An IDS usually looks for two suspicious cybercrime clues:

• Signatures or patterns of known attacks
• Abnormal deviations from regular activity

The system relies on pattern correlation to identify security threats, which allows the system to compare network packets to a database with signatures of known cyberattacks. Here are some of the most common cyber attacks an IDS can flag using pattern correlation:

• Scanning attacks that send packages to the network to collect information about open or closed ports, active hosts, permitted traffic types, and software versions
• Malware like trojans, ransomware, worms, viruses, and bots
• Buffer overflow attacks that replace database content with malicious executable files
• Asymmetric routing that sends malicious packets and bypasses security controls with different entry and exit routes
• Traffic flooding breaches that cause network overload (example: DDoS attacks)
• Protocol-specific attacks targeting to target, as the name suggests, specific protocols like TCP, ARP, ICMP, and so on

Once an IDS identifies any of the above anomalies, it flags and alerts the issue to your security team, which can either be a simple note in an audit log or an urgent message to the administrator. The responsibility then shifts to your team, who should troubleshoot the problem and identify (and eliminate) the root cause of the issue as quickly as possible.

The 3 Intrusion Detection Systems (IDS) Types (+ 2 Intrusion Detection Methods)

Let’s discuss the different ways you can classify an IDS. At the moment, there are three main types of intrusion detection software, depending on if you view these as a part of a single system: 

1. Network Intrusion Detection System (NIDS) 
2. Network Node Intrusion Detection System (NNIDS) 
3. Host Intrusion Detection System (HIDS) 

Let’s understand how each type of intrusion detection system works in more detail below.

1. Network Intrusion Detection System (NIDS)

A Network Intrusion Detection System (NIDS) is placed or deployed as strategic touchpoints across your network with the aim to cover these areas where traffic is most likely to be vulnerable to cyberattacks.

Typically, the system is applied to entire subnets and attempts to match passing traffic to a database of known attacks. It passively monitors all network traffic coming to the points on the network on which it’s deployed, plus you can make a NIDS more secure and harder to detect for intruders. As the intruder won’t realize their potential attack has already been detected by the NIDS, you’ll get more time to take remedial measures to protect your network.

There are a few shortcomings, too.

As a NIDS software tool monitors and analyzes a large amount of traffic, it can sometimes have low specificity. This means the system can miss an attack or fail to detect anomalies happening in encrypted traffic. Other times, the NIDS may need more manual involvement from you or your administrator to ensure they are configured correctly.

2. Network Node Intrusion Detection System (NNIDS) 

A Network Node Intrusion Detection System (NNIDS) is similar to the NIDS—but with one major difference: it’s applied to one host at a time instead of the entire subnet.

The system checks each node connected to your network for threats and malicious activity. Think of it as the security guard that checks the bags of each person outside of the mall.

3. Host Intrusion Detection System (HIDS)

A Host Intrusion Detection System (HIDS) is installed on independent network devices, meaning it runs on all the devices in the network with access to the internet and other parts of the enterprise network. 

It monitors the whole system’s file set and compares it to its previous “snapshots.“ The idea here is to identify significant differences outside normal business use and to notify the administrator in case of any missing or significantly altered settings or files. The HIDS primarily uses host-based actions, including file access across the systems, application use and files, and kernel logs.

Admittedly, the HIDS has a few advantages over the NIDS. This is because the former can look more closely at internal traffic and work as a second-line defense against malicious packets the latter failed to detect.

Besides the above three intrusion detection systems types, there are two main approaches to detecting intrusion: signature-based IDS and anomaly-based IDS.

• Signature-based IDS: A common approach used by most IDS to detect intrusion, this IDS focuses on looking for a signature, patterns, or a known identity of a general or specific intrusion event. 

That said, a signature-based IDS is only as good as how up-to-date its database is at a given moment, which is why you need systems to regularly update the database with current signatures or identities to ensure it can detect intruders promptly.

Another problem with signature-based IDS is that malicious agents can get around it by frequently changing small things about how they attack your system, which will make it difficult for the database to identify it. This also means the IDS will miss out on a completely new attack type—or any other attack that doesn’t exist in the database. 

Databases also become more comprehensive with time, which will correspondingly increase the processing load to analyze each connection and check it against the database.

• Anomaly-based IDS: Completely different from signature-based IDS, an anomaly-based IDS looks for all the kinds of unknown cyberattacks that are typically harder for a signature-based IDS to detect. 

It uses machine learning approaches to compare models of reliable behavior with abnormal or new user behavior, so anything that’s strange or unusual to the system gets instantly flagged. At the same time, the system isn’t perfect, meaning previously unknown, but legitimate behavior can also get flagged accidentally. 

Anomaly-based IDS also assumes network behavior is always predictable and that distinguishing good traffic from bad is simple. But considering the system looks at the behavior of traffic and not the payload, it can have problems figuring out which traffic to flag if a network is running on a non-standard configuration. 

That said, anomaly-based IDS is still a good option for determining when someone is sweeping or probing a network before launching a cyberattack. It can pick up signals in the network from the sweeps and probes, and instantly notify the administration to take the necessary precautions.

How to Get Started With an Intrusion Detection System

Below, we’ll help you figure out how to use an IDS to protect your system from malicious agents. Let’s take a quick look.

Determine Baseline and Pay Attention to Deployment

Establishing a baseline can ensure your IDS detects abnormal behavior on your network. Each network carries a different type of traffic, so when you have a clear initial baseline, you can greatly minimize—even prevent—false positives and false negatives. 

Besides the baseline, you also want to deploy the IDS at the highest point of visibility to overwhelm the system with data. 

While choosing the right IDS and deployment location will depend on the network and your security goals, placing the IDS at the edge of a network, behind the firewall, is an ideal place. If you’re having trouble dealing with intra-host traffic, consider installing multiple IDSes across the network.

Set Up Stealth Mode

You can set your IDS to run instant mode, making it hard to detect malicious agents. To do so, make sure the IDS has two network interfaces: one for the network and another for generating alerts. In addition, the IDS should use the monitored interface as input only.

Test the IDS while you’re at it. This will ensure it’s capable of detecting potential threats and responding to them properly. You can have security professionals do a penetration test or use test datasets. Regardless of your choice, be sure to run these tests regularly so that everything continues to work as expected.

Tune the IDS is to the Network and Regularly Update the Threat Database

There’s no harm in changing the default settings of the IDS where it makes sense for your network. The configuration should accommodate all your devices, applications, protocols, security points, ports, and other parts of the network. Once you’re done customizing configuration to apply to your network infrastructure, you’ll have a solid base ready for prompt detection.

Next, instruct your team to continually update the threat database. As mentioned, having an obsolete database will render the entire system ineffective, defeating the whole purpose of implementing an IDS in the first place. A good tip is to have all your IDSes and databases follow the principle of zero-trust security.

Investigate and Respond to Incidents Promptly

Training IT staff and having an incident response plan are prerequisites for effective cyber threat management. 

Your incident response plan must include skilled security personnel who know how to respond quickly and effectively without disrupting daily operations, plus define proper controls and established protocols to ensure your organization complies with applicable industry requirements (GDPR, HIPAA, SOC 2). If needed, add a secondary analysis platform to analyze threats after an IDS raises an alarm.