Intermediate · Identity and network defence · topic 18 of 43 · 30 min
Intrusion detection and prevention (IDS/IPS)
Explanation
Why firewalls are not enough
A firewall allows or blocks by address and port. But attacks often come through allowed doors: an exploit inside normal-looking HTTPS traffic, or malware calling out on port 443. An IDS looks deeper, at the content and pattern of traffic, and says "this looks like an attack".
IDS versus IPS
| IDS | IPS | |
|---|---|---|
| Position | Watches a copy of traffic (out of band) | Sits in the traffic path (inline) |
| Action | Alerts only | Alerts and can drop or block |
| Risk | Misses are not blocked | A false positive can block real users |
There are also network-based (NIDS) and host-based (HIDS) systems. A NIDS watches network traffic at key points. A HIDS runs on a server or laptop and watches files, logs and processes. Modern endpoint detection and response (EDR) tools are an advanced form of host-based detection.
How detection works
- Signature-based: matches known attack patterns, like a specific exploit string or a known malicious domain. Accurate for known attacks, blind to new ones.
- Anomaly-based: learns what normal looks like and alerts on unusual behaviour, like a server suddenly sending 50 GB at night. Can catch new attacks but gives more false alarms.
Popular open-source tools: Suricata and Snort (signature-based NIDS/IPS) and Zeek (records detailed network logs for analysis). Wazuh is an open-source host-based platform often used in home labs.
alert tcp any any -> $HOME_NET 3389 (msg:"Inbound RDP connection attempt"; flow:to_server; flags:S; sid:1000001; rev:1;)03/14/2026-02:11:05.123456 [**] [1:1000001:1] Inbound RDP connection attempt [**] [Priority: 3] {TCP} 198.51.100.23:51516 -> 10.0.0.5:3389True and false, positive and negative
| Result | Meaning | Example |
|---|---|---|
| True positive | Alert, and it really was an attack | Alert on an exploit; the server was being attacked |
| False positive | Alert, but it was harmless | Alert on "SQL injection" that was a developer testing |
| True negative | No alert, and nothing bad happened | Normal browsing, no alert |
| False negative | No alert, but there was an attack | A new malware variant that no rule knows |
False negatives are the most dangerous, because nobody knows to look. False positives waste analyst time and cause alert fatigue, where people start ignoring alerts. Tuning (adjusting rules so they fire on real problems) is a big part of the job.
Where to place sensors
- At the internet edge, behind the firewall, to see what got through.
- Between important zones, like user networks and the server network.
- In front of critical servers and in cloud networks (using traffic mirroring).
Common mistakes
- Installing an IDS and never reading its alerts.
- Turning every rule on: thousands of noisy alerts hide the real one.
- Putting an IPS inline in blocking mode on day one. Start in detect-only mode, tune, then block.
- Forgetting that encrypted traffic hides content. Sensors then rely on metadata (who, when, how much, which certificate) or on host-based tools.
Need help?
Stuck on a word or an idea? Search this course, or every course, and jump straight to the explanation or a worked question.
Try:
Watch the lesson
Intrusion detection and prevention (IDS/IPS) · 1/7
Attacks often come through allowed doors. An IDS looks deeper than a firewall.
Prefer a video by a teacher? Find free videos on “IDS vs IPS explained Suricata Snort signature anomaly detection” on YouTube ↗
In real life: Spotting a scan with a simple threshold
A SOC at a hospital network uses a rule: if one outside address touches 20 or more different ports on our servers within a minute, raise an alert. One night it fires for an address that hit 600 ports. The analyst confirms it is a scanner, checks that no unexpected port answered, and blocks the address. Most such alerts are routine, but the rule also catches internal machines that suddenly start scanning, which can mean malware is spreading.
from collections import defaultdict
hits = [("198.51.100.23", p) for p in range(1, 601)] + [("10.0.0.7", 443)]
ports = defaultdict(set)
for src, port in hits:
ports[src].add(port)
print([src for src, ps in ports.items() if len(ps) >= 20])Practice (0/3 done)
An IDS raised no alert, but later you find attackers were inside for weeks. What was this?
Write port_scanners(events, threshold) where events is a list of (source_ip, dest_port) tuples. Return a sorted list of source IPs that touched at least threshold DIFFERENT ports.
An IDS alert says "Possible SQL injection attempt" from 10.20.5.33 to the internal HR app. Write the five questions you would answer before deciding true or false positive.
Quick quiz
Read more (free)
Related help
Before this, learn
This topic builds on these. If something here feels new, open them first.
Related topics
- Network segmentation, zero trust and VPNsIdentity and network defence · same module
- Identity and access management, least privilege and RBACIdentity and network defence · same module
- Firewalls, IPS and VPNsComputer Networking (CCNA level) · Network security
- How defenders detect malwareMalware and web security
- Metasploit basics (in the lab)Ethical Hacking and Penetration Testing (legal labs) · Deeper lab skills: passwords, privilege, Metasploit, wireless
- SIEM and alert triageLogs, SIEM and incident response
Questions people ask about this
Open a question to see the answer and why. The first ones are this topic's own quiz, so try the quiz above before you peek.
Which device can block traffic as well as alert?
Answer: IPS
An IPS is inline and can drop malicious packets.
Signature-based detection is weakest against…
Answer: Brand-new attacks with no signature yet
It only knows patterns someone has already written.
What is alert fatigue?
Answer: Analysts ignoring alerts because there are too many false ones
Too much noise makes people miss real alerts.
Which open-source tool is known for producing detailed network logs for analysis?
Answer: Zeek
Zeek records rich logs of connections, DNS, HTTP and more.
Why start a new IPS in detect-only mode?
Answer: To tune rules before false positives start blocking real users
Tuning first avoids an outage caused by your own security tool.
Where should a company place its public web server in a firewall design?Related
Answer: DMZ
A DMZ lets the internet reach the server while keeping it separate from the trusted inside network.
What is a weakness of hash-based detection?Related
Answer: Any small change to the file gives a new hash
Hashes match exact files only.
IDS/endpoint tools often catch Metasploit because…Related
Answer: Many modules and payloads have known signatures
Known signatures and unusual connections are detectable.
Why correlate "many failures then a success" rather than alert on every failure?Related
Answer: It cuts noise and points to guessing that may have worked
Single failures are normal; the combination is meaningful.
Pass the quiz (60% or more) or mark this topic as done when you are ready.
Your progress is saved on this device only.
Next steps
- 1 more topic in “Identity and network defence” before its exam: Network segmentation, zero trust and VPNs.
- Module 4 exam: Identity and network defence · 12 questions · 20 min, without help. 4 topics of this module still to finish first.
- Then the next module, Logs, SIEM and incident response. 43 topics left in the course before the final exam.