- [Instructor] An Intrusion Detection System, or IDS,
provides an ability to receive an alert
when an attacker breaches your network security.
Therefore, IDS is critical
in protecting your network.
An IDS comes in as either an appliance
or a piece of software.
An appliance is a standalone solution.
It's a physical box you can attach
to your network without having to touch anything else.
IDSs monitor networks for suspicious activities
and send alarms.
IDSs are passive, meaning they don't take any actions
against the network traffic.
There are different types of IDSs.
The first type is signature based.
The signature-based IDSs rely on a predetermined set
of definitions characterizing various types
of attack traffic.
In this case, a definition refers
to a bit pattern of network traffic.
The second type is behavior-based IDSs,
the behavior-based IDSs determine
what's normal and what's not in terms of network activities.
The technologies related to IDSs
are intrusion prevention systems, or IPS,
and unified threat management, or UTM.
Compared to IDSs, IPSs are active,
meaning they take action against packets.
That is they drop suspicious packets.
UTMs are much more comprehensive
and they do almost everything.
You can think of it as a Swiss Army Knife
in network security.
It acts like an IDS.
It also does IPS functions
and then they also serve as firewalls
and anti-malware software.
Security information and event management, or SIEM,
collects network security-relevant data
from many sources, including firewalls,
IDSs, IPSs and log servers.
SIEM offers powerful visualization options
to correlate diverse network security data
and allows network security personnel
to make informed decisions
on various cybersecurity threats.
A UTM solution can have a SIEM feature too.
Although a signature-based IDS is more common,
more and more IDSs combine both signature-based
and behavior-based approaches.
With the recent advances in machine learning,
behavior-based IDS solutions
are gaining more traction.
Whether it's standalone or built in
as part of another product,
an IDS is an essential element of your network defense.