Catalog
concept#Security#Observability#Analytics#Architecture

Intrusion Detection System (IDS)

Concept and architecture for detecting intrusions by monitoring and analyzing network or host data.

An intrusion detection system (IDS) monitors networks or hosts to identify suspicious activity and security breaches.
Established
High

Classification

  • High
  • Technical
  • Architectural
  • Intermediate

Technical context

SIEM systems for long-term correlationSOAR for orchestration of responsesThreat intelligence platforms

Principles & goals

Layered detection: combine network and host dataDetect-before-prevent: clear separation of detection and responseContinuous tuning to reduce false positives
Run
Enterprise, Domain, Team

Use cases & scenarios

Compromises

  • Overwhelming the SOC with noise and false alerts
  • Misconfigurations leading to blind spots
  • Dependence on outdated signatures against new threats
  • Use a combination of network and host-based sensors
  • Perform regular tuning and validation of signatures
  • Contextualize alerts with asset and user information

I/O & resources

  • Network traffic/packet captures
  • Host and system logs
  • Threat intelligence and signature feeds
  • Alert notifications with context
  • Logged data for forensic analysis
  • Metrics for effectiveness measurement

Description

An intrusion detection system (IDS) monitors networks or hosts to identify suspicious activity and security breaches. It inspects traffic, logs and system state to trigger alerts and support incident correlation. IDS approaches include signature and anomaly detection and require tuning, continuous monitoring and a defined response process.

✔

  • Early detection of attacks and anomalies
  • Increased visibility into network and host activity
  • Support for forensic analysis and incident response

✖

  • High false-positive rate without careful tuning
  • Limited detection of encrypted or highly obfuscated attacks
  • Operational overhead for maintenance, signature updates and monitoring

  • True positive rate (detection rate)

    Share of actually detected malicious events among all real incidents.

  • False positive rate

    Share of false alarms among all generated alerts.

  • Mean time to detect (MTTD)

    Average time between attack start and first detection by the IDS.

Suricata for network-based detection

Open-source network IDS combining signature and protocol analysis, widely used as a NIDS in many environments.

OSSEC as host-based solution

Host-based IDS/log-management solution with file integrity monitoring, log analysis and hardening features.

Combination of IDS and SIEM in the SOC

Using an IDS for detection plus a SIEM for long-term correlation and orchestration of responses in a security operations center.

1

Define requirements and coverage goals; plan sensors and placement.

2

Deploy sensors, connect telemetry and initialize signatures.

3

Perform tuning phase; analyze false positives and adjust rules.

4

Integrate with SIEM/SOAR for correlation and automated response.

⚠️ Technical debt & bottlenecks

  • Outdated signatures and unmaintained rule sets
  • Lack of automation in alert triage
  • Insufficient scalability of the analysis infrastructure
Processing latency at high packet ratesStorage and archival requirements for logsQuality and completeness of telemetry data
  • Using IDS as sole security measure without response process
  • Importing signature feeds unchecked and producing overloaded rules
  • Placing sensors at unsuitable points that see no relevant traffic
  • Not allocating enough time for tuning
  • Insufficient log retention for forensic analysis
  • Lack of validation for threat feeds
Network and protocol knowledge (TCP/IP, HTTP, DNS)Security operations and incident response experienceRule and signature creation as well as log analysis
Detection accuracy and false-positive rateScalability under high network throughputIntegrability with SIEM, SOAR and threat feeds
  • • Legal constraints for packet capture and data protection
  • • Network architecture may limit sensor placement
  • • Resource limits (CPU, memory) on sensors