Training Trains Internship
Student login
← Network Security learning path
Network Security · Module 5 of 10

IDS, IPS and monitoring

Detect and stop malicious activity.

📖 Key ideas

  1. IDS detects and alerts on suspicious traffic.
  2. IPS detects and blocks it inline.
  3. Signature-based detection matches known patterns; anomaly-based finds unusual behaviour.
  4. Tools: Snort, Suricata, Zeek.
  5. Logs feed a SIEM for correlation.
💡 Real-life example: An IDS is a burglar alarm; an IPS is an alarm that also locks the door automatically.
IDSIntrusion Detection System
IPSIntrusion Prevention System
SignatureKnown attack pattern
Anomaly detectionFinding unusual behaviour