IDSs which detect attacks by capturing and analyzing network packets. Listening on a network segment or switch, one network-based IDS can monitor the network traffic affecting multiple hosts that are connected to the network segment.
Sources:
CNSSI 4009-2015
under intrusion detection systems (IDS), (network-based)
Software that automates the intrusion detection process.
Sources:
CNSSI 4009-2015
from
NIST SP 800-94
NIST SP 800-12 Rev. 1
under Intrusion Detection System (IDS)
from
NIST SP 800-94
IDSs which operate on information collected from within an individual computer system. This vantage point allows host-based IDSs to determine exactly which processes and user accounts are involved in a particular attack on the Operating System. Furthermore, unlike network-based IDSs, host- based IDSs can more readily “see” the intended outcome of an attempted attack, because they can directly access and monitor the data files and system processes usually targeted by attacks.
Sources:
CNSSI 4009-2015
under intrusion detection system (IDS), (host-based)
A security service that monitors and analyzes network or system events for the purpose of finding, and providing real-time or near real-time warning of, attempts to access system resources in an unauthorized manner.
Sources:
NIST SP 800-82r3
under intrusion detection system
from
RFC 4949 - adapted
Software that looks for suspicious activity and alerts administrators.
Sources:
NISTIR 7711
under Intrusion Detection System