IDS/IPS Training Materials — Secure In Security

Secure In Security — IDS/IPS Training Materials Contact / About / Policy

Intrusion Detection &
Prevention Systems

IDS / IPS

Introduction to Intrusion Detection & Prevention Systems

In today’s threat landscape, organizations face a constant barrage of cyberattacks targeting their networks, systems, and sensitive data. Intrusion Detection and Prevention Systems (IDS/IPS) are foundational security technologies that provide real-time visibility into malicious or suspicious activity, forming a critical layer of defense-in-depth strategy.

What Is an IDS?

An Intrusion Detection System (IDS) is a monitoring tool that analyzes network traffic or host activity to identify potential attacks, policy violations, or malicious behavior. When suspicious activity is detected, the IDS generates an alert for security personnel to investigate.

Key Concept

An IDS detects and alerts — it does not block traffic. Think of it as a security camera: it observes and records, but a human (or another system) must take action.

What Is an IPS?

An Intrusion Prevention System (IPS) builds upon IDS capabilities by adding the ability to automatically take action against detected threats in real time. Rather than only alerting, an IPS can drop malicious packets, block connections, reset sessions, or quarantine hosts — all without human intervention.

Key Concept

An IPS detects and prevents — it sits inline with network traffic and can actively block attacks. Think of it as both a security camera and a lockable door.

IDS vs. IPS: A Comparison

Feature	IDS	IPS
Response Mode	Passive (alert only)	Active (block + alert)
Placement	Out-of-band / mirrored traffic	Inline (traffic passes through)
Latency Impact	None — does not touch live traffic	Minimal — adds processing overhead
False Positive Risk	Low operational impact	Can disrupt legitimate traffic
Primary Use Case	Visibility & forensic logging	Real-time threat prevention
Requires Human Action?	Yes — analyst must respond	No — automated response possible

Why IDS/IPS Matters

IDS/IPS systems are essential components of a mature cybersecurity program. They contribute to:

Regulatory ComplianceMany frameworks (PCI DSS, HIPAA, NIST) mandate intrusion detection capabilities.
Incident ResponseIDS logs provide invaluable forensic data for investigating security incidents.
Threat IntelligenceIDS/IPS sensors collect data used to identify attack trends and refine security policy.
Risk ReductionIPS deployments reduce Mean Time to Respond (MTTR) by blocking threats automatically.
Network VisibilityProvide a continuous, real-time view of network behavior and anomalies.

Types of IDS/IPS Systems

Network-Based IDS/IPS (NIDS/NIPS)

Network-based systems monitor traffic flowing across the network. Sensors are deployed at strategic points (e.g., at the perimeter, between network segments, at data center gateways) and analyze packets in real time.

Aspect	Details
Traffic Coverage	Monitors all traffic on a network segment
Deployment	Inline (IPS) or on a SPAN/mirror port (IDS)
Visibility	Excellent for east-west and north-south traffic
Blind Spots	Cannot inspect encrypted traffic without SSL/TLS inspection
Examples	Snort, Suricata, Cisco Firepower, Palo Alto Threat Prevention

Host-Based IDS/IPS (HIDS/HIPS)

Host-based systems are installed directly on individual endpoints (servers, workstations, VMs) and monitor activity at the operating system and application level. They excel at detecting insider threats, privilege escalation, and file-system tampering.

Aspect	Details
Monitoring Scope	System calls, file integrity, log files, registry (Windows)
Deployment	Agent installed on each monitored host
Visibility	Excellent for local activity; blind to network-level attacks
Overhead	Consumes endpoint CPU/memory resources
Examples	OSSEC, Wazuh, Tripwire, CrowdStrike Falcon, Carbon Black

Wireless IDS/IPS (WIDS/WIPS)

Wireless intrusion systems monitor 802.11 (Wi-Fi) networks for unauthorized access points, rogue devices, de-authentication attacks, and protocol anomalies specific to wireless environments.

Important

A rogue access point connected to the corporate network bypasses all wired security controls. WIDS/WIPS is essential wherever Wi-Fi is deployed.

Cloud-Based & Virtual IDS/IPS

As organizations migrate to cloud environments (AWS, Azure, GCP), traditional hardware-based IDS/IPS must evolve. Virtual and cloud-native IDS/IPS solutions provide comparable protection in virtualized and containerized environments.

AWS GuardDuty: Machine learning-based threat detection for AWS environments.
Azure Defender / Microsoft Sentinel: Integrated threat detection across Azure and hybrid environments.
VMware NSX Distributed IDS/IPS: Micro-segmentation with per-workload IDS/IPS policies.

IDS/IPS Detection Methods

IDS/IPS systems employ several distinct methodologies to identify threats. Understanding each approach — including its strengths and limitations — is critical for effective deployment and tuning.

Signature-Based Detection

Signature-based (or pattern-matching) detection compares network traffic or system activity against a database of known attack patterns (signatures). It is the most widely deployed method and excels at catching known threats with high accuracy.

Attribute	Details
How It Works	Matches traffic patterns against a library of known threat signatures
Strengths	Low false positive rate; fast and efficient; well-understood
Weaknesses	Cannot detect zero-day attacks; requires constant signature updates
Maintenance	Signature database must be updated frequently (daily or more)
Best For	Detecting known malware, exploits, and attack tools

Anomaly-Based Detection

Anomaly-based (behavioral) detection establishes a baseline of normal network behavior and raises alerts when deviations exceed a defined threshold. This method can detect previously unknown threats but is prone to higher false positive rates during the tuning phase.

Attribute	Details
How It Works	Learns ‘normal’ behavior; flags statistical deviations
Strengths	Can detect zero-day attacks and novel threats
Weaknesses	High false positive rate if baseline is not well-tuned
Baseline Period	Typically 2–4 weeks of learning before going active
Best For	Detecting insider threats, APT lateral movement, data exfiltration

Stateful Protocol Analysis

Stateful Protocol Analysis (SPA) compares observed network protocol behavior against the expected behavior as defined by vendor-neutral protocol standards. It can detect protocol abuse, evasion techniques, and unexpected command sequences.

Detects protocol violations (e.g., malformed HTTP headers, non-standard FTP commands).
Effective against evasion techniques that exploit protocol parsing quirks.
Computationally intensive — may impact performance at high throughput.

Hybrid Detection

Modern IDS/IPS platforms combine all three methods to maximize coverage. For example, a next-generation IPS (NGIPS) may use:

Signature matching for known threat indicators.
Machine learning anomaly detection for behavioral analysis.
Protocol decoding and analysis for evasion resistance.
Threat intelligence feeds for dynamic, real-time indicator enrichment.

Pro Tip

No single detection method is sufficient on its own. Layering detection approaches — and correlating IDS/IPS data with SIEM events — dramatically improves detection fidelity.

Deployment Architecture & Placement

Strategic Sensor Placement

The value of an IDS/IPS is directly tied to where sensors are placed. Improper placement creates blind spots; optimal placement provides maximum visibility with minimal performance impact.

Location	What It Monitors
Internet Perimeter (outside firewall)	All inbound/outbound Internet traffic; external attack attempts
DMZ	Traffic to/from public-facing servers (web, email, DNS)
Inside Firewall (internal boundary)	Permitted traffic that passed the firewall; internal threat actors
Data Center / Server Segment	East-west traffic between servers; lateral movement detection
Remote Access / VPN Termination	Authenticated remote user activity
Cloud Workload (virtual sensor)	Traffic within cloud VPCs and between microservices

Inline vs. Passive (Out-of-Band) Deployment

IPS systems are deployed inline — all traffic passes through the sensor before reaching its destination. IDS sensors are typically passive, receiving a copy of traffic via a SPAN port or network TAP.

Mode	Description	Use Case
Inline (IPS)	Traffic flows through the device; can block in real time	Active threat prevention at network boundaries
Passive/SPAN (IDS)	Mirror of traffic; no blocking capability	Monitoring, forensics, low-risk environments
TAP-based (IDS)	Hardware TAP sends exact copy of traffic	High-fidelity monitoring without SPAN limitations

Warning

SPAN ports may drop packets under high load, potentially causing the IDS to miss traffic. Hardware TAPs provide a more reliable passive copy for high-traffic environments.

Common Attack Types Detected by IDS/IPS

IDS/IPS systems are configured to detect a broad spectrum of attacks. The following table outlines the most common threat categories, attack examples, and typical detection methods.

Attack Category	Examples	Detection Method	Severity
Reconnaissance	Port scans, ping sweeps, OS fingerprinting	Anomaly / Signature	Low–Medium
Denial of Service (DoS/DDoS)	SYN flood, UDP flood, ICMP flood, HTTP flood	Anomaly / Signature	High–Critical
Exploitation	SQL injection, buffer overflow, RCE exploits	Signature / Protocol	Critical
Malware Communication	C2 beaconing, botnet traffic, ransomware callbacks	Signature / Threat Intel	Critical
Lateral Movement	Pass-the-hash, Kerberoasting, SMB exploitation	Anomaly / Signature	High–Critical
Data Exfiltration	Unusual outbound data volume, DNS tunneling	Anomaly / Protocol	Critical
Brute Force	SSH brute force, RDP password spray, credential stuffing	Anomaly / Signature	Medium–High
Man-in-the-Middle	ARP spoofing, SSL stripping, rogue DHCP	Protocol / Anomaly	High
Web Application Attacks	XSS, CSRF, directory traversal, LFI/RFI	Signature / Protocol	High–Critical
Protocol Abuse	Malformed packets, protocol tunneling, covert channels	Protocol Analysis	Medium–High

Alert Management & System Tuning

Understanding Alert Types

Not every alert generated by an IDS/IPS represents a real threat. Security analysts must understand the four possible alert outcomes:

Alert Type	Definition	Example	Action Required
True Positive (TP)	Real attack correctly detected	Signature fires on actual SQL injection	Investigate & respond
False Positive (FP)	Benign activity incorrectly flagged as attack	Internal scanner triggers exploit signature	Tune/whitelist
True Negative (TN)	Benign activity correctly not flagged	Normal web browsing passes without alert	None — correct behavior
False Negative (FN)	Real attack NOT detected	Zero-day exploit bypasses all signatures	Review & update rules

Key Goal

The goal of IDS/IPS tuning is to minimize False Positives (analyst fatigue) while ensuring False Negatives (missed attacks) remain as close to zero as possible.

Alert Prioritization

Effective SOC teams use a risk-based approach to prioritize alerts. Consider the following factors when triaging IDS/IPS events:

Asset CriticalityIs the affected host a domain controller, database server, or workstation?
Attack StageIs this reconnaissance, exploitation, or post-exploitation activity?
Confidence LevelIs this a high-confidence signature match or a low-confidence behavioral anomaly?
Threat Intelligence ContextHas this source IP been linked to known threat actors?
Volume & FrequencyIs this an isolated event or part of a coordinated campaign?

Tuning Strategies

A poorly tuned IDS/IPS generates alert fatigue — the condition where analysts are overwhelmed with false alarms and begin ignoring alerts. Follow these tuning best practices:

Establish a BaselineRun the IDS/IPS in monitor-only mode for 2–4 weeks to understand normal traffic patterns.
Suppress Known-Good ActivityWhitelist legitimate scanners, monitoring tools, and authorized vulnerability assessment traffic.
Tune Threshold RulesAdjust sensitivity thresholds for anomaly rules based on observed traffic volumes.
Prioritize Critical AssetsApply stricter rules and lower thresholds for high-value targets.
Review RegularlyConduct monthly tuning reviews to address new false positives and remove outdated signatures.
Correlate with SIEMUse a SIEM to correlate IDS/IPS events with other log sources to reduce noise and improve context.

IDS/IPS and Regulatory Compliance

Many information security frameworks and regulations explicitly require or strongly recommend intrusion detection capabilities. Understanding these requirements is essential for compliance-driven organizations.

Framework / Regulation	IDS/IPS Requirement
PCI DSS (v4.0)	Requirement 11.4: Detect and alert on intrusions. Requires IDS/IPS on all in-scope networks with signatures updated at least every 6 months.
HIPAA Security Rule	Requires implementation of hardware, software, and/or procedural mechanisms to record and examine activity in systems containing ePHI.
NIST SP 800-94	Provides the definitive government guide to IDS/IPS. Recommends layered deployment of NIDS, HIDS, and wireless IDS.
ISO/IEC 27001	Annex A, Control A.12.4: Logging and monitoring. IDS/IPS supports monitoring requirements for anomalous activity.
NERC CIP (Utilities)	CIP-007-6 requires security event monitoring for Bulk Electric System (BES) Cyber Systems, including IDS capabilities.
SOC 2	Availability and Confidentiality criteria require continuous monitoring of network activity for intrusion attempts.
CMMC (Defense)	Level 2/3 requires implementation of intrusion detection and prevention for DoD contractor networks.

Best Practices & Advanced Topics

IDS/IPS Best Practices

Defense in DepthIDS/IPS should be one layer of a multi-layered security architecture, complemented by firewalls, EDR, WAF, and SIEM.
Keep Signatures CurrentConfigure automatic signature updates and establish a process for emergency updates following zero-day disclosures.
Enable Logging & RetentionCapture full packet logs for high-severity events. Retain logs for a minimum of 90 days online and 1 year archived.
Integrate with SIEMForward all IDS/IPS events to a SIEM/SOAR platform for correlation, enrichment, and automated response.
Document Rules & PoliciesMaintain a register of all custom rules, suppressions, and whitelists with change history.
Perform Regular TestingValidate IDS/IPS coverage using penetration testing, red team exercises, and breach-and-attack simulation (BAS) tools.
Plan for Failopen/FailcloseDefine whether the IPS should allow or block all traffic if the sensor fails — align with risk tolerance.

Next-Generation IPS (NGIPS)

Next-generation IPS platforms extend traditional IPS with:

Application AwarenessDeep packet inspection that identifies applications regardless of port (e.g., identifying BitTorrent over port 443).
User Identity ContextIntegrates with Active Directory to correlate traffic with user identities.
Threat Intelligence IntegrationReal-time enrichment of events with global threat intel feeds.
SSL/TLS InspectionDecryption of encrypted traffic to detect threats hidden within HTTPS sessions.
Sandboxing IntegrationForwarding suspicious files to a sandboxing solution for dynamic analysis.

IDS/IPS Evasion Techniques

Security professionals must understand evasion techniques to properly defend against them and validate IDS/IPS effectiveness:

Evasion Technique	Description & Defense
IP Fragmentation	Attacker fragments malicious payload across multiple IP packets. Defense: Configure IDS/IPS to reassemble fragments before inspection.
TTL Manipulation	Packets crafted with varying TTL values to confuse sensor vs. destination host analysis. Defense: Normalize TTL values before inspection.
Protocol Obfuscation	Encoding or encrypting attack payload to bypass signature detection. Defense: Deploy SSL inspection and use behavioral analysis.
Low-and-Slow Attacks	Spreading attack activity over long periods to avoid threshold-based detection. Defense: Use anomaly detection with long baselines.
Polymorphic Malware	Malware that changes its signature with each infection. Defense: Behavioral/heuristic detection; sandbox analysis.
Traffic Flooding	Overwhelming the IDS/IPS with high traffic volume to force packet drops. Defense: Hardware-accelerated sensors; rate limiting.

IDS/IPS in a Zero Trust Architecture

In a Zero Trust model, the assumption is that threats exist both outside and inside the network perimeter. IDS/IPS plays a critical role in Zero Trust by:

Monitoring micro-segmented east-west traffic between workloads.
Providing continuous verification that authenticated sessions are not carrying malicious payloads.
Generating telemetry that informs dynamic access control decisions.
Detecting lateral movement by compromised users or machines that passed initial authentication.

IDS/IPS in the Incident Response Process

IDS/IPS systems are not standalone tools — they are integral to the incident response lifecycle. The following table maps IDS/IPS functions to the NIST SP 800-61 incident response phases.

IR Phase	IDS/IPS Role
1. Preparation	Define detection use cases; configure alert thresholds; integrate with SIEM/SOAR; train analysts on triage procedures.
2. Detection & Analysis	IDS/IPS generates initial alert; analyst reviews event details, source/destination IP, protocol, and signature metadata.
3. Containment	IPS blocks attacking source IP; SOAR automation quarantines affected host; IDS confirms no further malicious traffic.
4. Eradication	IDS/IPS logs used to identify scope of compromise; additional signatures deployed to detect re-infection attempts.
5. Recovery	Monitor restored systems with heightened alerting for 30 days post-incident to detect recurrence.
6. Lessons Learned	Review IDS/IPS missed detections; update signatures and rules; adjust thresholds based on incident findings.

Analyst Investigation Workflow

When an IDS/IPS alert fires, analysts should follow a structured investigation process:

Acknowledge the AlertLog receipt time and assign to appropriate analyst tier.
Review Alert ContextExamine source/destination IP, port, protocol, signature details, and confidence level.
Enrich with Threat IntelligenceQuery threat intel platforms for IP/domain reputation.
Correlate with Other EventsSearch SIEM for related events from the same source or targeting the same destination.
Determine ScopeIdentify all systems that may have been affected.
Classify the IncidentAssign severity based on asset criticality and attack stage.
Escalate or ResolveEscalate true positives per the incident response plan; close false positives with documentation.

Glossary

Term	Definition
Alert Fatigue	Condition where analysts are overwhelmed by excessive false positive alerts, leading to reduced vigilance.
Anomaly Detection	IDS/IPS method that detects deviations from established normal behavior baselines.
APT	Advanced Persistent Threat — sophisticated, long-term attack campaign typically state-sponsored.
Baseline	A profile of ‘normal’ network or host behavior used as a reference for anomaly detection.
C2 / C&C	Command and Control — infrastructure used by attackers to communicate with compromised systems.
Defense in Depth	Security strategy employing multiple, overlapping layers of controls so that no single failure compromises the system.
DPI	Deep Packet Inspection — technique that examines the full content of network packets, including payload.
EDR	Endpoint Detection and Response — security solution providing host-level threat detection and response.
False Negative	A real attack that was not detected by the IDS/IPS — the most dangerous outcome.
False Positive	A benign event that was incorrectly flagged as an attack by the IDS/IPS.
HIDS	Host-based Intrusion Detection System — monitors activity on an individual endpoint.
IDS	Intrusion Detection System — passively monitors and alerts on suspicious activity.
IPS	Intrusion Prevention System — actively blocks and prevents detected malicious activity inline.
Lateral Movement	Technique used by attackers to move through a network after initial compromise.
NIDS	Network-based Intrusion Detection System — monitors network traffic for suspicious activity.
NGIPS	Next-Generation IPS — combines traditional IPS with application awareness, user identity, and threat intelligence.
Signature	A pattern or rule that describes a known attack or malicious behavior for detection purposes.
SIEM	Security Information and Event Management — platform that aggregates and correlates security events.
SOAR	Security Orchestration, Automation and Response — platform that automates incident response workflows.
SOC	Security Operations Center — team responsible for monitoring, detecting, and responding to security threats.
SPAN Port	Switched Port Analyzer — network switch feature that copies traffic to an IDS sensor for passive monitoring.
SSL/TLS Inspection	Process of decrypting encrypted traffic for security inspection, then re-encrypting for delivery.
TAP	Network Test Access Point — hardware device that passively copies network traffic for monitoring.
True Positive	A real attack that was correctly detected by the IDS/IPS.
Zero-Day	A vulnerability or exploit unknown to the vendor/defender for which no patch or signature currently exists.
Zero Trust	Security model that requires continuous verification of every user, device, and connection with no implicit trust.

References & Further Reading

Official Standards & Frameworks

NIST SP 800-94 Rev 1: Guide to Intrusion Detection and Prevention Systems (IDPS) — National Institute of Standards and Technology.
NIST SP 800-61 Rev 2: Computer Security Incident Handling Guide — National Institute of Standards and Technology.
PCI DSS v4.0 Requirement 11.4: Intrusion detection/prevention techniques — PCI Security Standards Council.
MITRE ATT&CK Framework: Enterprise Tactics, Techniques, and Procedures — https://attack.mitre.org
CIS Controls v8: Control 13 — Network Monitoring and Defense — Center for Internet Security.

Open-Source Tools

Snort IDS/IPS (Cisco): https://snort.org — Industry-standard open-source network IDS/IPS.
Suricata: https://suricata.io — High-performance, multi-threaded open-source IDS/IPS/NSM engine.
Zeek (formerly Bro): https://zeek.org — Powerful network analysis framework.
OSSEC: https://www.ossec.net — Open-source HIDS with log analysis, file integrity, and rootkit detection.
Wazuh: https://wazuh.com — Extended OSSEC with SIEM capabilities and cloud support.

Introduction to Intrusion Detection & Prevention Systems

What Is an IDS?

What Is an IPS?

IDS vs. IPS: A Comparison

Why IDS/IPS Matters

Types of IDS/IPS Systems

Network-Based IDS/IPS (NIDS/NIPS)

Host-Based IDS/IPS (HIDS/HIPS)

Wireless IDS/IPS (WIDS/WIPS)

Cloud-Based & Virtual IDS/IPS

IDS/IPS Detection Methods

Signature-Based Detection

Anomaly-Based Detection

Stateful Protocol Analysis

Hybrid Detection

Deployment Architecture & Placement

Strategic Sensor Placement

Inline vs. Passive (Out-of-Band) Deployment

Common Attack Types Detected by IDS/IPS

Alert Management & System Tuning

Understanding Alert Types

Alert Prioritization

Tuning Strategies

IDS/IPS and Regulatory Compliance

Best Practices & Advanced Topics

IDS/IPS Best Practices

Next-Generation IPS (NGIPS)

IDS/IPS Evasion Techniques

IDS/IPS in a Zero Trust Architecture

IDS/IPS in the Incident Response Process

Analyst Investigation Workflow

Glossary

References & Further Reading

Official Standards & Frameworks

Open-Source Tools

Recommended Reading