Intrusion Detection Systems

Here I will talk about Intrusion Detection Systems (IDS). The 1st. step is to give some definitions.
According to the Webopedia, an IDS inspects all the inbound and the outbound network activity. Its purpose is to identify suspicious patterns that may originate from someone attempting to attack a system. Generally the attacker wants to break into the system, or he wants to compromise the system in some way.
The Wikipedia has a similar definition. 1st. the purpose of any security system is to keep the confidentiality (the information is avail just to authorized persons), integrity (the information is keeped exactly as it was recorded by user applications), and availability (the information is avail anytime the user needs it).
Wikipedia mentions that IDSs tasks generally don't include intrusion prevention. The principal reason for use IDSs is to identify attempts of intrusion.
There are three principal kinds of IDSs categories:

• misuse detection vs anomaly detection: in misuse detection, the system has a great database of signatures from known attacks previously recorded. The detection is done comparing collected data to some recorded signature. If it matches the IDS reports an intrusion attempt. It looks like an antivirus application. This system is so good as the signature database. Anomaly is something different from the normal behavior. It is something easier to detect, as someone must to define what is a normal behavior (f. ex. traffic load, kind of protocols, packet sizes, etc). Both cases always have an amount of reported false positives. In some moment some signature may represent a correct access, and some behavior reported as not normal may be correct too.
• network-based vs host-based systems: a network-based IDS (NIDS) analyses every single packet searching for malicious packets projected to bypass any firewall with its simplistic rules. A host-based system inspects all the activities on each individual host.
• passive systems vs reactive systems: a passive IDS detects a possible intrusion, logs the event, and reports an alert. A reactive IDS responds to the probably intrusion logging off the user. It also reprograms the firewall to block the network traffic from the suspected source.

The diference between firewalls and IDSs is that firewalls look to void intrusion restricting the network traffic. They don't signal inside network attacks.