Network Security
Host-Based IDS (HIDS)
Also known as: HIDS, Host IDS
Definition
An intrusion-detection agent installed on a server or endpoint that monitors local files, processes, logs, and system calls for malicious activity.
Examples
- Wazuh agent alerting on a suspicious cron job created in /etc/cron.d.
- OSSEC detecting that a critical binary in /usr/bin has changed checksum.
Related terms
Intrusion Detection System (IDS)
A passive security control that monitors network or host activity for malicious behaviour and raises alerts without blocking traffic.
Network-Based IDS (NIDS)
An intrusion-detection sensor that inspects traffic captured from a network segment to identify malicious patterns and policy violations.
EDR (Endpoint Detection and Response)
An endpoint security technology that continuously records process, file, registry and network activity to detect, investigate and respond to threats on hosts.
Signature-Based Detection
A detection method that compares observed traffic, files, or behaviour against a database of known-bad patterns (signatures) to flag malicious activity.
Anomaly-Based Detection
A detection approach that builds a baseline of normal activity and flags deviations from it as potentially malicious.
Log Analysis
Log Analysis — definition coming soon.