an intrusion detection system
A firewall is like a gate that allows or blocks visitors at the door. But what about a visitor you legitimately let in who then starts trying door handles down the hallway? You need a watchman walking the floors, recognizing suspicious behavior even among allowed guests. An intrusion detection system (IDS) is that watchman: it monitors network traffic or system activity, looking for signs of attacks or policy violations, and raises an alert when it spots something suspicious.
An IDS works by inspecting traffic more deeply than a firewall and matching it against indicators of trouble, by two main approaches. Signature-based detection compares traffic to a database of known attack patterns — like antivirus matching known malware fingerprints — accurate for known threats but blind to brand-new ones. Anomaly-based detection learns a baseline of normal behavior and flags deviations (a sudden traffic spike, a host suddenly scanning many ports) — able to catch novel attacks but prone to false alarms. The close cousin, an intrusion prevention system (IPS), sits inline and goes a step further: rather than just alerting, it can actively block or drop the offending traffic in real time.
Why it matters: an IDS/IPS complements the firewall rather than replacing it. The firewall decides which connections are allowed; the IDS/IPS inspects what flows inside the allowed traffic, catching the attacks a firewall waves through. Together they form layered defense. The honest caveats: an IDS is only as good as its signatures and tuning — it misses unknown attacks (false negatives) and cries wolf on benign oddities (false positives), and a flood of low-quality alerts can be worse than none because real warnings get buried. And detection is not prevention: a plain IDS tells you something happened; stopping it requires an IPS or human response.
An IDS watching a network notices one internal host suddenly opening connections to thousands of different ports across many machines in seconds — the signature of a port scan. The firewall allowed each connection individually, but the IDS recognizes the pattern and raises an alert (an IPS could block the host outright).
Watches behavior inside allowed traffic; IPS can also block.
An IDS has false positives and false negatives: it misses novel attacks and over-alerts on harmless oddities. Alert fatigue is real — too many low-value alerts can bury the one that matters. Detection alone is not prevention.