📘 Topic: Intrusion Detection (IDS)

Subject: Information Technology Infrastructure

---

1. 📌 Introduction

In modern IT systems, networks and servers are constantly exposed to cyber threats such as hacking, malware, and unauthorized access. Even strong security systems like firewalls cannot stop all attacks.

👉 To detect such suspicious activities, organizations use Intrusion Detection Systems (IDS).

---

2. ✅ Definition

Intrusion Detection is the process of monitoring network or system activities to detect unauthorized access, malicious activities, or policy violations and alert administrators.

👉 Simple idea: It helps to “detect attacks happening inside or outside the system.”

---

3. 🎯 Objectives of Intrusion Detection

• Detect unauthorized access attempts
• Identify malicious activities early
• Monitor system and network traffic
• Generate alerts for administrators
• Improve overall security response

---

4. 🧩 What is an Intrusion?

An intrusion is any unauthorized or harmful activity in a system or network.

📊 Examples:

• Hacking attempts 🔓
• Malware attacks 🦠
• Data theft 💾
• Password cracking attempts

---

5. ⚙️ Types of Intrusion Detection Systems (IDS)

---

🔑 1. Network-based IDS (NIDS)

• Monitors network traffic
• Placed at network entry points

📊 Example:

• Detects suspicious packets in internet traffic

---

🔑 2. Host-based IDS (HIDS)

• Installed on individual devices
• Monitors system files and processes

📊 Example:

• Detecting unauthorized file changes on a server

---

🔑 3. Hybrid IDS

• Combination of NIDS and HIDS
• Provides complete protection

---

6. 🔍 Detection Methods

---

🔑 1. Signature-Based Detection

• Compares activity with known attack patterns

📊 Example:

• Detecting known virus signatures

---

🔑 2. Anomaly-Based Detection

• Detects unusual behavior in system

📊 Example:

• Sudden high network traffic at night

---

🔑 3. Behavior-Based Detection

• Analyzes user/system behavior patterns

---

7. 📊 IDS Working Diagram

Network Traffic → IDS Monitoring → Analysis Engine → Alert Generation → Admin Response

---

8. 🧠 Real-Life Example

In a banking system:

• IDS monitors login attempts
• Detects repeated wrong password attempts
• Sends alert to security team
• System blocks suspicious IP

👉 Result:

• Attack is detected early
• System remains secure

---

9. ⚙️ IDS vs IPS (Important Exam Point)

Feature	IDS	IPS
Full Form	Intrusion Detection System	Intrusion Prevention System
Function	Detects attacks	Detects + blocks attacks
Action	Sends alert	Takes automatic action
Usage	Monitoring	Active protection

---

10. 📌 Importance of Intrusion Detection

• Early detection of cyberattacks
• Improves system security
• Helps in incident response
• Protects sensitive data
• Reduces damage from attacks

---

11. ⚠️ Limitations

• Can generate false alarms
• Cannot always prevent attacks (only detect)
• Requires constant monitoring
• Performance overhead on systems
• Needs regular updates

---

12. 📝 Likely Exam Questions

⭐ Short Questions:

1. Define intrusion detection.
2. What is IDS?
3. What is network-based IDS?
4. What is anomaly detection?
5. Give one difference between IDS and IPS.

---

⭐ Long Questions:

6. Explain intrusion detection system with diagram.
7. Describe types of IDS in detail.
8. Explain detection methods used in IDS.
9. Differentiate between IDS and IPS.
10. Discuss importance and limitations of IDS.

---

13. 📌 Quick Summary / Conclusion

• Intrusion Detection helps in identifying unauthorized or malicious activities in IT systems.

• It includes:

  • ✔ Network-based IDS
  • ✔ Host-based IDS
  • ✔ Detection methods (signature, anomaly, behavior)

👉 Final Idea: Intrusion detection is essential for early threat detection, security monitoring, and protecting IT infrastructure from cyberattacks.

---

✅ Exam Tip: Always include:

• Definition
• Types of IDS
• Detection methods
• IDS vs IPS comparison
• Diagram + example for full marks