{"licence":{"name":"CC BY-SA 4.0","spdx":"CC-BY-SA-4.0","url":"https://creativecommons.org/licenses/by-sa/4.0/","attribution":"Atlas, a bilingual technical dictionary (https://atlas.maintz.dev/)"},"id":"security/intrusion-detection-system","url":{"en":"https://atlas.maintz.dev/en/terms/security/intrusion-detection-system/","da":"https://atlas.maintz.dev/da/terms/security/intrusion-detection-system/"},"term":{"en":"Intrusion detection system (IDS)","da":"Indtrængningsdetektion (IDS)"},"aka":{"en":["IDS"],"da":["IDS","system til indtrængningsdetektion"]},"domain":["security"],"cluster":"controls","layer":"network","status":"current","era":1987,"summary":{"en":"A watcher that inspects network traffic or a machine's activity and warns when it spots signs of an attack - without stopping it.","da":"En vagt, der holder øje med netværkstrafik eller en maskines aktivitet og advarer ved tegn på angreb - uden selv at stoppe det."},"body":{"formal":{"en":"A system that examines copies of network packets or activity on a host, compares them against known attack patterns or normal behaviour, and reports matches as alerts while leaving the traffic itself untouched.","da":"Et system, der undersøger kopier af netværkspakker eller aktivitet på en maskine, sammenligner dem med kendte angrebsmønstre eller normal adfærd og melder fund som alarmer, mens selve trafikken får lov at passere."},"plain":{"en":"Like a burglar alarm - it rings when someone breaks in, but it does not lock the door.","da":"Som en tyverialarm - den hyler, når nogen bryder ind, men den låser ikke døren."},"inPractice":{"en":"At a regional hospital, the IDS sees a PC in the finance office trying to reach hundreds of other machines within seconds and sends an alert to the SIEM, where the on-duty analyst decides what to do.","da":"På et regionshospital ser IDS'en en pc i økonomiafdelingen forsøge at kontakte hundredvis af andre maskiner på få sekunder og sender en alarm til SIEM'en, hvor den vagthavende analytiker beslutter, hvad der skal ske."},"whyItMatters":{"en":"Because it only watches, it can be placed almost anywhere without risk of blocking real work - but someone must act on its warnings, or they are worth nothing.","da":"Fordi den kun ser på, kan den placeres næsten overalt uden risiko for at blokere rigtigt arbejde - men nogen skal handle på advarslerne, ellers er de intet værd."}},"deepDive":{"en":"The conceptual basis for intrusion detection is Dorothy Denning's 1987 paper \"An Intrusion-Detection Model\" (IEEE Transactions on Software Engineering), which proposed profiling normal subject behaviour and flagging statistical deviations. NIST SP 800-94 (2007) still provides the standard taxonomy: network-based (NIDS), wireless, network behaviour analysis (flow-based) and host-based (HIDS) systems, using three detection methodologies - signature-based matching, anomaly-based detection against a baseline, and stateful protocol analysis that checks traffic against the expected behaviour of protocols such as HTTP, DNS or SMB.\n\nA NIDS receives a copy of traffic from a switch SPAN/mirror port or a network TAP, so it is passive and cannot add latency or drop packets - but it also cannot prevent anything, and mirrored ports silently drop frames under load. The best-known open-source engines are Snort (1998), Suricata (multi-threaded, maintained by the Open Information Security Foundation) and Zeek, formerly Bro, which is less a signature matcher than a protocol analyser producing rich connection, DNS, HTTP and TLS logs. Rule sets such as Emerging Threats or Snort's Talos rules match on header fields, byte content, protocol-parsed buffers and flow state. Host-based IDS (OSSEC, Wazuh, auditd-based tools) inspect logs, file integrity and system calls on the host itself and overlap heavily with EDR.\n\nClassic weaknesses are well documented. Ptacek and Newsham (1998) showed that differences in IP fragment and TCP segment reassembly between the sensor and the target let attackers insert or evade traffic; modern engines counter this with target-based reassembly policies. Encryption is the larger practical limit: with TLS 1.3 and encrypted SNI/ECH, a NIDS sees little beyond metadata unless traffic is decrypted at a proxy, so detection shifts to JA3/JA4-style fingerprints, certificate metadata, DNS and flow behaviour. Anomaly detection suffers from the base-rate fallacy described by Axelsson (1999): because genuine attacks are rare, even a very low false-positive rate produces far more false alarms than true ones, which is why tuning and alert triage dominate operating cost.\n\nAn IDS differs from an IPS in placement and authority - out of band and alert-only versus inline and blocking - and most modern products can run in either mode. Its output is only useful when forwarded to a SIEM or SOC that correlates and acts on it; CIS Controls v8 Control 13 (network monitoring and defense) and ISO/IEC 27002:2022 control 8.16 (monitoring activities) are the usual anchors.","da":"Det teoretiske grundlag for indtrængningsdetektion er Dorothy Dennings artikel \"An Intrusion-Detection Model\" fra 1987 (IEEE Transactions on Software Engineering), der foreslog at profilere subjekters normale adfærd og markere statistiske afvigelser. NIST SP 800-94 (2007) leverer stadig standardinddelingen: netværksbaserede (NIDS), trådløse, netværksadfærdsanalyse (flowbaseret) og værtsbaserede (HIDS) systemer, som bruger tre detektionsmetoder - signaturbaseret matchning, anomalibaseret detektion op mod en baseline og stateful protokolanalyse, der holder trafikken op mod den forventede adfærd for protokoller som HTTP, DNS eller SMB.\n\nEn NIDS får en kopi af trafikken fra en SPAN-/mirror-port på en switch eller fra en netværks-TAP, så den er passiv og hverken kan tilføje forsinkelse eller tabe pakker - men den kan heller ikke forhindre noget, og spejlede porte taber stille og roligt rammer under høj belastning. De mest kendte open source-motorer er Snort (1998), Suricata (flertrådet, vedligeholdt af Open Information Security Foundation) og Zeek, tidligere Bro, som mindre er en signaturmatcher end en protokolanalysator, der producerer detaljerede logs over forbindelser, DNS, HTTP og TLS. Regelsæt som Emerging Threats eller Snorts Talos-regler matcher på headerfelter, byteindhold, protokolparsede buffere og flowtilstand. Værtsbaserede IDS'er (OSSEC, Wazuh, auditd-baserede værktøjer) undersøger logs, filintegritet og systemkald på selve værten og overlapper meget med EDR.\n\nDe klassiske svagheder er veldokumenterede. Ptacek og Newsham (1998) viste, at forskelle i samling af IP-fragmenter og TCP-segmenter mellem sensor og mål lader angribere indsætte eller skjule trafik; moderne motorer modvirker det med målbaserede reassembly-politikker. Kryptering er den største praktiske begrænsning: med TLS 1.3 og krypteret SNI/ECH ser en NIDS kun lidt ud over metadata, medmindre trafikken dekrypteres i en proxy, så detektionen flytter over på JA3/JA4-fingeraftryk, certifikatmetadata, DNS og flowadfærd. Anomalidetektion lider under den base-rate-fejlslutning, Axelsson beskrev i 1999: fordi reelle angreb er sjældne, giver selv en meget lav falsk-positiv-rate langt flere falske end ægte alarmer, og derfor dominerer tuning og triage driftsomkostningerne.\n\nEn IDS adskiller sig fra en IPS i placering og beføjelser - uden for trafikvejen og kun alarmerende frem for inline og blokerende - og de fleste moderne produkter kan køre i begge tilstande. Outputtet er kun nyttigt, når det sendes videre til en SIEM eller SOC, der korrelerer og handler på det; CIS Controls v8 Control 13 (netværksovervågning og -forsvar) og ISO/IEC 27002:2022 kontrol 8.16 (overvågningsaktiviteter) er de sædvanlige ankre."},"howTo":{"steps":{"en":["Decide what the IDS must detect, based on your threat assessment and most valuable systems, and agree who in the SOC or IT operations acts on its alerts and how fast.","Choose where to place it, with network sensors at the internet edge and between key segments such as server, user and OT networks, and host-based agents on critical servers.","Feed each network sensor from a TAP or a SPAN port sized for peak traffic, and check regularly that it sees all the traffic without dropping packets.","Install a maintained rule set, such as Emerging Threats for Suricata or Snort, update it automatically every day and disable rules for protocols you do not use.","Send alerts, together with flow, DNS and TLS metadata, to the SIEM, where they are correlated with logs from endpoints and identity systems.","Tune during the first weeks by tracing the cause of each false positive, writing narrow exceptions and keeping a list of every suppressed rule with its reason.","Write a playbook for the most important alert types that says who triages, how to verify and when to isolate a machine or escalate to incident response.","Test detection at least once a year with harmless test traffic or a purple-team exercise, and review coverage whenever the network or the use of encryption changes."],"da":["Beslut, hvad IDS'en skal opdage, ud fra jeres trusselsvurdering og vigtigste systemer, og aftal, hvem i SOC'en eller IT-driften der handler på alarmerne, og hvor hurtigt.","Vælg placeringen, med netværkssensorer ved internetkanten og mellem vigtige segmenter som server-, bruger- og OT-net, og værtsbaserede agenter på kritiske servere.","Forsyn hver netværkssensor fra en TAP eller en SPAN-port dimensioneret til spidsbelastning, og tjek jævnligt, at den ser al trafikken uden at tabe pakker.","Installér et vedligeholdt regelsæt, fx Emerging Threats til Suricata eller Snort, opdatér det automatisk hver dag, og slå regler fra for protokoller, I ikke bruger.","Send alarmer sammen med flow-, DNS- og TLS-metadata til SIEM'en, hvor de korreleres med logs fra endpoints og identitetssystemer.","Finjustér reglerne i de første uger ved at finde årsagen til hver falsk positiv, skrive snævre undtagelser og føre en liste over alle undertrykte regler med begrundelse.","Skriv en playbook for de vigtigste alarmtyper, der beskriver, hvem der triagerer, hvordan fundet bekræftes, og hvornår en maskine isoleres eller sagen eskaleres til incident response.","Test detektionen mindst én gang om året med harmløs testtrafik eller en purple team-øvelse, og gennemgå dækningen, når netværket eller brugen af kryptering ændrer sig."]},"pitfalls":{"en":["Installing sensors but having nobody who reads and acts on the alerts.","Placing the only sensor at the internet edge, so an attacker moving between internal machines is never seen.","Leaving the default rules untuned until the flood of false alarms makes analysts ignore everything.","Forgetting that encryption hides the payload, so detection must rely on metadata or on decryption at a proxy."],"da":["At installere sensorer uden at have nogen, der læser og handler på alarmerne.","At placere den eneste sensor ved internetkanten, så en angriber, der bevæger sig mellem interne maskiner, aldrig bliver set.","At lade standardreglerne stå utunede, til strømmen af falske alarmer får analytikerne til at ignorere alt.","At glemme, at kryptering skjuler indholdet, så detektionen må bygge på metadata eller på dekryptering i en proxy."]},"guides":[{"title":"NIST SP 800-94 - Guide to Intrusion Detection and Prevention Systems (IDPS)","url":"https://csrc.nist.gov/pubs/sp/800/94/final","publisher":"NIST","tier":"standard"},{"title":"CIS Critical Security Controls - Control 13 Network Monitoring and Defense","url":"https://www.cisecurity.org/controls/network-monitoring-and-defense","publisher":"Center for Internet Security","tier":"standard"},{"title":"10 Steps to Cyber Security - Logging and monitoring","url":"https://www.ncsc.gov.uk/collection/10-steps/logging-and-monitoring","publisher":"NCSC UK","tier":"official-doc"},{"title":"Suricata documentation - Rule Management with Suricata-Update","url":"https://docs.suricata.io/en/latest/rule-management/suricata-update.html","publisher":"Open Information Security Foundation","tier":"official-doc"}]},"edges":[{"type":"requires","to":"cs/network","confidence":"high","strength":"normal"},{"type":"requires","to":"cs/packet","confidence":"high","strength":"normal"},{"type":"kind-of","to":"security/control","confidence":"high","strength":"normal"},{"type":"contrasts-with","to":"security/intrusion-prevention-system","why":{"en":"An IDS only watches and warns; an IPS sits in the path of traffic and blocks what it judges harmful.","da":"En IDS ser kun på og advarer; en IPS sidder i trafikkens vej og blokerer det, den vurderer som skadeligt."},"confidence":"high","strength":"primary"},{"type":"used-with","to":"security/siem","confidence":"high","strength":"normal"},{"type":"used-with","to":"security/security-monitoring","confidence":"high","strength":"normal"}],"depth":3,"sources":[{"title":"Cyber Security Fast Track - Ordliste","tier":"course-material"},{"title":"NIST SP 800-94 - Guide to Intrusion Detection and Prevention Systems (IDPS)","tier":"standard","publisher":"NIST"}],"draft":true}