Intrusion detection

Intrusion detection is the process of identifying attacks, malware, and policy violations by matching network traffic and host activity against signature rules or behavioral baselines. Intrusion detection systems (IDS) may be network-based, inspecting traffic on the wire, or host-based, monitoring activity on a single system.

See also

• Network Forensics

Tools

• FlowGREP is a basic IDS/IPS tool written in Python
• OSSEC
• Snort