Nids

A network intrusion detection system (NIDS) is a security technology that monitors network traffic for signs of malicious activity and policy violations. It analyzes packets flowing across a network segment to identify potential intrusions or attacks and typically generates alerts for security personnel or integrated security information and event management systems. NIDS are generally deployed at strategic points in the network, such as at the perimeter or inside segments, and often operate in a passive mode by listening to mirrored traffic; in some configurations, inline deployment can provide intrusion prevention capabilities.

Detection methods used by NIDS include signature-based detection, which matches traffic against a database of known attack patterns; anomaly-based detection, which flags deviations from established normal behavior; and protocol analysis or stateful inspection, which checks for abnormal sequences or violations in application protocols.

NIDS rely on data sources such as raw network packets, NetFlow or other flow data, and logs from intermediate devices. Deep packet inspection may be employed, though encrypted traffic can limit payload analysis. Core components typically include sensors (monitoring points), an analysis engine, and a management console that aggregates alerts, stores logs, and enables configuration and correlation with other security tools.

Common examples include Snort and Suricata, which are widely used for signature-based intrusion detection, and Zeek (formerly Bro), which emphasizes comprehensive network analytics. NIDS are distinct from host-based intrusion detection systems (HIDS), which monitor individual devices, and from intrusion prevention systems (IPS), which attempt to block threats in real time.

Limitations include the need for regular updates to signatures, tuning to reduce false positives, handling high traffic volumes, and attacker evasion techniques.