What Are IDS and IPS? Network Intrusion Detection and Prevention Systems

When a firewall permits network traffic an important question arises:

How can we tell whether there is an attack inside the traffic that has been permitted?

For example, a web server's TCP/443 port may be reachable from the internet.

From the firewall's point of view this traffic:

Source → Internet

Destination → Web Server

Port → TCP/443

may be permitted in this form.

However, over that same permitted connection the attacker;

an exploit attempt,

a malicious payload,

protocol abuse,

a web attack

or reconnaissance

may try to carry out any of these.

It is at exactly this point that access control alone is not enough.

For network traffic:

"is it permitted?"

alongside this question:

"is it malicious?"

this question too needs to be answered.

The fundamental technologies used to meet this need are:

IDS - Intrusion Detection System

and

IPS - Intrusion Prevention System

as they are called.

IDS and IPS systems try to detect known or suspicious attack behaviour by analyzing network traffic.

The fundamental difference between them can be summarized simply in this way:

IDS = Detect

IPS = Detect + Prevent

However, modern intrusion detection and prevention is far more than this.

Signature-Based Detection,

Anomaly Detection,

Behavioral Analysis,

Protocol Inspection,

Exploit Detection,

Threat Intelligence,

Network Telemetry

many mechanisms such as these can be used together.

What Is IDS?

IDS:

Intrusion Detection System

is the security system that tries to detect suspicious or malicious behaviour by analyzing network or system activity.

IDS generally does not block the traffic directly.

It produces an alarm.

What Does IDS Do?

IDS can try to detect activities of the following kind:

Port Scan

Exploit Attempt

Brute Force

Malware Communication

Suspicious Protocol Usage

Policy Violation

What Is IPS?

IPS:

Intrusion Prevention System

is the security system that can automatically block suspicious network traffic as well as detecting it.

What Is the Difference Between IDS and IPS?

The fundamental difference:

IDS → Passive Detection

IPS → Active Prevention

can be expressed in this way.

What Is Passive Detection?

It monitors the traffic but does not block the connection directly.

What Is Active Prevention?

When a threat is detected a packet drop, session reset or block operation can be performed.

What Is NIDS?

NIDS:

Network Intrusion Detection System

is the type of IDS that analyzes network traffic.

What Is NIPS?

NIPS:

Network Intrusion Prevention System

is the type of IPS that can block attack traffic by working on the network path.

What Is HIDS?

HIDS:

Host-Based Intrusion Detection System

is the intrusion detection approach that runs on an endpoint or server.

What Is HIPS?

HIPS:

Host-Based Intrusion Prevention System

is the security technology that provides prevention capability at host level.

What Is the Difference Between NIDS and HIDS?

NIDS looks at network traffic.

HIDS looks at host activity.

Where Is IDS/IPS Positioned in Network Security?

According to the architecture it can be used at different points:

Internet Edge

DMZ

Data Center

Internal Network

Critical Segment

What Is Perimeter IDS/IPS?

It analyzes the traffic between the internet and the corporate network.

What Is Internal IDS/IPS?

It analyzes the traffic between internal network segments.

Why Is East-West IDS/IPS Important?

It can help to detect lateral movement and internal attack activity.

What Is North-South IDS/IPS?

It analyzes the traffic between the internet and the corporate network.

What Is Inline IPS?

It is the IPS deployment model that works on the network traffic path.

What Is the Advantage of Working Inline?

It can block the attack in real time.

Is Inline IPS Risky?

An incorrect detection can cut network traffic.

For this reason tuning is critical.

What Is Out-of-Band IDS?

It works outside the traffic path.

It analyzes copied network traffic.

What Is the Advantage of Out-of-Band Detection?

It does not affect production traffic directly.

What Is the Disadvantage?

The direct blocking capability is limited.

What Is a SPAN Port?

It is the mechanism that allows switch traffic to be copied to an analysis device.

What Is Port Mirroring?

Similarly to SPAN, it is the copying of network traffic to another interface.

What Is a Network TAP?

It is the visibility mechanism used to carry network traffic to a monitoring device.

What Is the Difference Between a TAP and SPAN?

SPAN copies traffic through the switch.

A TAP can provide more direct traffic visibility.

How Does IDS Analyze Traffic?

It uses various detection methods.

For example:

Signature-Based Detection

Anomaly-Based Detection

Behavioral Detection

Protocol Analysis

What Is Signature-Based Detection?

It is the matching of known attack patterns with predefined signatures.

What Is a Signature?

It is the detection pattern that describes a particular attack or malicious activity.

What Is an Example of a Signature?

A particular exploit payload structure,

a malicious command,

a protocol anomaly

they can be markers such as these.

What Is the Advantage of Signature-Based Detection?

It can provide high accuracy on known attacks.

What Is the Disadvantage?

It can miss new or modified attack patterns.

What Is a Zero-Day Attack?

It is an attack carried out through a new vulnerability for which there is not yet a widespread signature or patch.

Can a Signature-Based IDS Detect Zero-Day?

Not always.

Anomaly and behavioural detection may be needed.

What Is Anomaly-Based Detection?

It tries to detect deviations from normal network behaviour.

What Is a Network Baseline?

It is the normal behaviour profile of the network.

What Can a Baseline Contain?

Connection frequency

Protocol usage

Traffic volume

Communication pattern

An Anomaly Detection Example

A server that normally connects only to the internal network:

Unknown External IP

continuously establishing connections over this can be an anomaly.

What Is Behavioral Detection?

Instead of a single packet it analyzes the behaviour pattern over time.

A Behavioral Detection Example

Endpoint:

connections to 100 different IPs in a short time

↓

Possible Network Scan

What Is Protocol Analysis?

It is the analysis of whether the network protocol behaviour complies with the standards.

What Is a Protocol Anomaly?

It is network behaviour that does not comply with the protocol standard.

What Is Protocol Abuse?

It is the use of a valid network protocol for a malicious purpose.

What Is Deep Packet Inspection?

It is the detailed analysis of the header and payload information of a network packet.

Why Is DPI Important for IDS/IPS?

The attack payload can be inside the packet.

Is Encrypted Traffic a Problem for IDS/IPS?

Yes.

TLS encryption reduces payload visibility.

Can TLS Inspection and IDS/IPS Be Used Together?

Yes.

The firewall or proxy can send the decrypted traffic to the IPS engine.

What Is Encrypted Traffic Analysis?

It is analysis performed through metadata and behaviour without decrypting the payload.

What Is an Exploit?

It is the technique or piece of code used to take advantage of a vulnerability.

What Is Exploit Detection?

It is the detection of exploit usage in network traffic.

What Is CVE?

CVE:

Common Vulnerabilities and Exposures

is the standard identity system used for known vulnerabilities.

Can an IDS Signature Be Associated With a CVE?

Yes.

An IPS signature can detect a particular CVE exploit attempt.

What Is CVSS?

CVSS:

Common Vulnerability Scoring System

is the vulnerability severity evaluation standard.

Can IPS Apply Policy According to CVSS?

In some products threat severity and CVSS information can be used in the policy decision.

What Is a Vulnerability-Based IPS Policy?

It is the prioritization of IPS signatures according to the actual asset vulnerability information in the organization.

What Is Virtual Patching?

It is the blocking of an exploit attempt with a network security control until the vulnerability patch is applied.

Can IPS Perform Virtual Patching?

Yes.

By blocking particular exploit signatures the risk can be reduced temporarily.

Does Virtual Patching Take the Place of a Real Patch?

No.

It must be thought of as a temporary compensating control.

Why Is a Threat Signature Update Important?

The signature database must be up to date so that new attack patterns can be detected.

Should Signature Updates Be Automatic?

In most architectures automatic or central management is preferred.

What Is an IPS Signature Category?

It is the grouping of signatures according to the threat type.

For example:

Web Attack

Malware

Exploit

Scan

Brute Force

What Is Severity?

It is the importance level of the threat event.

For example:

Low

Medium

High

Critical

Should IPS Block Every Signature?

No.

Tuning according to the environment is needed.

What Is IPS Tuning?

It is the optimization of the detection and prevention policy according to the network environment.

Why Is Tuning Necessary?

The default policy can produce too many false positives.

What Is a False Positive?

It is normal activity being perceived as an attack.

Why Is a False Positive a Problem?

It creates unnecessary alerts and blocking.

What Is Alert Fatigue?

It is the security analyst missing important events because of too many alarms.

What Is a False Negative?

It is a real attack not being detected.

Why Is a False Negative More Dangerous?

The attack can continue without detection.

What Is Detection Accuracy?

It is the system's ability to distinguish correctly between a real threat and normal activity.

What Is Detection Engineering?

It is the design, testing and optimization of security detection rules.

How Should the IPS Tuning Process Be?

Monitor

↓

Analyze

↓

Tune

↓

Test

↓

Enforce

Should IDS Be Run in Alert Mode First?

In new deployments it can be a strong transition approach.

What Is IPS Detect-Only Mode?

It detects the threat but does not block it.

What Is Block Mode?

After detection the connection is blocked.

What Is Drop Packet?

It is the malicious packet not being transmitted over the network.

What Is Reset Session?

It is the termination of the active TCP session.

What Is Block Source?

It is the blocking of the threat source IP for a certain period.

What Is Dynamic Blocking?

It is the automatic application of a network block as a result of detection.

Is Auto-Block Risky?

In the case of a false positive legitimate traffic can be affected.

What Is an IPS Policy Whitelist?

It is leaving certain trusted traffic outside detection or prevention.

What Happens If Whitelisting Is Used Too Much?

A detection gap can occur.

What Is Exception Management?

It is the controlled management of the rules exempted from the detection or block policy.

Should an Exception Be Without a Time Limit?

As far as possible, no.

An expiration date must be used.

What Is IDS/IPS Evasion?

It is the attacker modifying the traffic in order to bypass the detection mechanism.

What Is an Evasion Technique?

It is a technique aimed at bypassing the detection signature.

What Is Fragmentation Evasion?

It is trying to hide the malicious payload from detection by splitting it into different packets.

What Is TCP Segmentation Evasion?

It is the splitting of the payload into different TCP segments.

What Is Encoding Evasion?

It is the modification of the payload with different encoding methods.

What Is Obfuscation?

It is the hiding of malicious content in order to escape detection.

What Is Protocol Evasion?

It is the use of differences in protocol behaviour for detection bypass.

What Is IDS Normalization?

It is the standardization of the traffic before detection.

What Is Packet Reassembly?

It is the reassembling of fragmented packets for analysis.

What Is Stream Reassembly?

It is the reconstruction of the TCP stream.

Why Is IDS/IPS Performance Important?

In a high traffic environment it can create inspection latency and packet loss.

What Is IPS Throughput?

It is the traffic capacity that can be processed while security inspection is on.

Does Datasheet Throughput Show Real Performance?

Not always.

Active signatures,

TLS inspection,

packet size

factors such as these have an effect.

What Is Packet Per Second - PPS?

It is the number of packets processed per second.

Do Small Packets Affect Performance?

Yes.

More packet inspection is needed within the same bandwidth.

What Is Latency?

It is the delay that occurs during the processing of network traffic.

Can Inline IPS Create Latency?

Yes.

Correct sizing is needed.

What Is Capacity Planning?

It is the planning of system capacity according to traffic growth and security inspection needs.

What Is High Availability IDS/IPS?

It is the redundant architecture that provides service continuity in the event of a security appliance failure.

What Is Fail-Open IPS?

It is the traffic continuing to pass when the IPS fails.

What Is Fail-Close IPS?

It is the traffic being blocked when the IPS fails.

Which One Is More Secure?

Fail-close is stricter in terms of security.

However, it can create an availability risk.

What Is a Bypass Interface?

It is the mechanism that allows the traffic to be bypassed physically or logically in the event of an appliance failure.

What Is the Difference Between IDS/IPS and a Firewall?

Firewall:

Access Control

IDS/IPS:

Threat Detection and Prevention

it is focused on this.

Can There Be IPS Inside an NGFW?

Yes.

Integrated IPS is common on modern NGFW platforms.

Is a Dedicated IPS Necessary?

It can vary according to traffic volume, architecture and threat requirements.

What Is the Difference Between IDS/IPS and NDR?

IDS/IPS mostly focuses on signature and packet inspection.

NDR can use broader network telemetry and behavioural analytics.

What Is the Difference Between IDS/IPS and EDR?

IDS/IPS analyzes network traffic.

EDR analyzes endpoint processes and behaviour.

What Is the Difference Between IDS/IPS and a WAF?

IDS/IPS provides general network attack detection.

A WAF focuses on web application-specific traffic.

Does a WAF Take the Place of IPS?

No.

How Do IDS/IPS and the SIEM Work Together?

IDS/IPS events can be sent to the SIEM.

What Does the SIEM Provide?

An IDS alert:

Firewall Log

Authentication Log

EDR Alert

DNS Log

can be correlated with these.

What Is Correlation?

It is the analysis of more than one security event together.

Is an IDS Alert an Incident on Its Own?

Not always.

Context is needed.

What Is Alert Enrichment?

It is the addition of extra information to the alert.

For example:

Asset Criticality

Threat Intelligence

User Identity

CVE

How Is Threat Intelligence Used in IDS/IPS?

Traffic can be compared with known malicious IPs, domains or attack infrastructure.

What Is an IOC?

IOC:

Indicator of Compromise

is the technical marker that indicates the possibility of a compromise.

What Is IOC-Based Detection?

It is threat detection performed through IOCs such as malicious IPs, domains or signatures.

What Is the Limit of IOC Detection?

IOCs can change rapidly.

What Is TTP?

TTP:

Tactics, Techniques and Procedures

expresses attacker behaviour patterns.

Why Is TTP-Based Detection Strong?

Even if the IP or the hash changes the attacker behaviour can remain similar.

Can MITRE ATT&CK Be Used for IDS/IPS?

Yes.

Detection coverage can be matched with attacker tactics and techniques.

In Which MITRE Tactics Does IDS/IPS Provide Value?

For example:

Reconnaissance

Discovery

Lateral Movement

Command and Control

Exfiltration

What Is a Network Scan?

It is the scan performed to identify the hosts and services on the network.

Can IDS Detect a Network Scan?

Yes.

The connection pattern to a large number of ports or hosts can be analyzed.

What Is a Port Scan?

It is trying to determine the open ports on a system.

What Is a Horizontal Scan?

It is the scanning of a large number of hosts over the same port.

What Is a Vertical Scan?

It is the scanning of a large number of ports on a single host.

What Is a Slow Scan?

It is the scan operation being performed slowly in order to escape detection.

Can a Slow Scan Be Detected?

Behavioural analytics with a long time window may be needed.

What Is Brute Force Detection?

It is the detection of a large number of failed authentication attempts.

Can Password Spraying Be Detected?

If network and authentication logs are analyzed together, yes.

What Is Exploit Attempt Detection?

It is the detection of known vulnerability exploitation patterns.

Can Command Injection Be Detected by IDS?

If the payload is visible some attack patterns can be detected.

Can SQL Injection Be Detected by IDS?

Some SQL injection patterns can be seen with a detection signature.

Does IDS Completely Block SQL Injection?

No.

Application-level secure coding and a WAF are needed as well.

What Is Malware Communication Detection?

It is the detection of the communication of a compromised endpoint with malicious infrastructure.

What Is Command and Control - C2?

It is the control communication between the compromised device and the attacker infrastructure.

Can C2 Detection Be Performed With IDS?

If there is a known signature or malicious destination, yes.

What Is Beaconing?

It is the endpoint establishing a connection to the C2 server at certain intervals.

Can Beaconing Be Seen by IDS?

It can be difficult for a basic IDS.

NDR behavioural analysis can be stronger.

What Is Data Exfiltration Detection?

It is the detection of unusual data transfer behaviour to outside the organization.

Can IDS Detect Data Exfiltration?

If there is a known pattern it can help.

Behavioural NDR can provide broader visibility.

Can DNS Tunneling Be Detected by IDS?

Depending on the pattern and the signature, yes.

What Is Protocol Tunneling?

It is the hiding of other traffic inside one protocol.

What Is ICMP Tunneling?

It is data communication being carried out over ICMP packets.

Can IDS Detect ICMP Tunneling?

Anomalous ICMP payload and behaviour can be analyzed.

What Is SMB Attack Detection?

It is the detection of exploit, brute force or lateral movement patterns on the SMB protocol.

What Is RDP Attack Detection?

It is the detection of RDP brute force or suspicious access behaviour.

What Is SSH Attack Detection?

It is the detection of SSH brute force and unusual access attempts.

Is IDS/IPS Used in Internal Lateral Movement Detection?

Yes.

However, East-West visibility must be provided.

What Happens If East-West Traffic Is Not Visible?

An internal attack activity detection gap can occur.

What Is Sensor Placement?

It is the placing of the IDS/IPS sensors at the right points on the network.

Why Is Sensor Placement Critical?

An IDS in the wrong place may not see the necessary traffic.

Where Can IDS Sensors Be Positioned?

Internet Edge

DMZ

Data Center Core

Server Segment

Critical VLAN

What Is a Blind Spot?

It is the network area in which security monitoring cannot see the traffic.

What Is a Network Visibility Gap?

It is the situation in which network activity is not visible to the security tooling.

Does Traffic Asymmetry Affect IDS?

Yes.

If only one direction of the session is visible the analysis becomes difficult.

Does Encapsulation Affect IDS?

GRE, VXLAN or tunnel traffic can affect visibility.

What Is VXLAN?

Virtual Extensible LAN is a modern data center overlay network technology.

Can IDS Analyze VXLAN Traffic?

It varies according to the product capability and the architecture.

What Is Cloud IDS/IPS?

They are the intrusion detection/prevention solutions that analyze the network traffic in the cloud environment.

Why Is Cloud Traffic Visibility Difficult?

The traditional SPAN/TAP models are applied differently in the cloud.

What Is VPC Traffic Mirroring?

It is the copying of cloud network traffic to a monitoring system.

Where Is Cloud IDS Used?

VPC/VNet

Cloud Firewall

Cloud Gateway

Workload Traffic

What Is Kubernetes Network IDS?

It is the network threat detection approach for container and Kubernetes traffic.

Why Is Kubernetes East-West Traffic Critical?

Pod-to-pod communication is very intense.

What Is Service Mesh Security?

It is the control of microservice communication through policy and identity.

Can IDS See Service Mesh Traffic?

It depends on the encryption and the architecture.

Why Is IDS/IPS Logging Important?

It makes it possible for detection events to be recorded for forensic purposes and monitoring.

Which Information Should an IDS Alert Contain?

Timestamp

Source IP

Destination IP

Port

Signature

Severity

Action

Should Packet Evidence Be Kept?

It can be useful according to the risk and the storage capacity.

What Is PCAP Evidence?

It is the recording of the packet data at the moment of the alert.

Is PCAP Useful for Forensics?

Yes.

It can provide detailed incident analysis.

What Is IDS Log Retention?

It is the storing of alert and traffic data for a certain period.

How Is the Log Retention Period Determined?

It must be determined according to risk, compliance and investigation need.

What Is IDS Alert Triage?

It is the first evaluation of the importance of the alert and of whether it is a real threat.

What Is Examined in the Triage Process?

Source

Destination

Asset Criticality

Signature

Context

How Is Alert Priority Determined?

Severity alone is not enough.

What Is Risk-Based Alerting?

It is the evaluation of threat severity together with asset criticality and context.

An Example

Medium Severity Exploit

Domain Controller

=

High Priority Incident

Should IDS/IPS Be Monitored by the SOC?

Yes.

What Is an IDS/IPS Use Case?

It is the detection scenario aimed at detecting a particular attack behaviour.

Example IDS Use Cases

Port Scan

Exploit Attempt

Malicious Payload

C2 Communication

Brute Force

Should an IPS Block Event Be Investigated by the SOC?

On critical events, yes.

Being blocked does not mean that there has been no compromise.

Does a "Blocked" Event Mean That We Are Safe?

No.

The attacker may have tried another method.

What Can Multiple IPS Alerts Mean?

It can be a coordinated attack or scanning activity.

What Is IDS/IPS Health Monitoring?

It is the continuous monitoring of whether the sensor and the inspection engine are working.

What Is a Silent Failure?

Even if the IDS appears to be working it may not be analyzing traffic.

How Is Sensor Health Checked?

Traffic volume

Packet drop

Signature update

CPU

Memory

Why Is Packet Drop Risky for IDS?

A dropped packet cannot be analyzed.

Does IDS Packet Loss Affect Detection Capability?

Yes.

IDS/IPS Capacity KPIs

Traffic Throughput

Packet Drop Rate

CPU Usage

Memory Usage

Detection KPIs

True Positive Rate

False Positive Rate

Alert Volume

Mean Time to Triage

IPS Prevention KPIs

Blocked Threat Count

Critical Exploit Blocks

Policy Exceptions

IDS/IPS KRIs

Outdated Signatures

High Packet Drop

Disabled IPS Policy

Excessive Exceptions

IDS/IPS Security Checklist

• Is IDS/IPS active?
• Is the signature database up to date?
• Has the IPS policy been tuned according to the environment?
• Are false positives being monitored?
• Are the critical signatures in block mode?
• Is East-West traffic visible?
• Is the sensor placement correct?
• Is the packet drop rate being tracked?
• Has TLS traffic visibility been evaluated?
• Do the IDS logs go to the SIEM?
• Is alert enrichment being performed?
• Is the exception list being reviewed?
• Is the IPS firmware up to date?
• Is HA being tested?

The Most Frequently Made Mistakes in IDS/IPS

The mistakes frequently seen in organizations:

• Installing IDS/IPS and leaving it with the default policy
• Not performing signature updates
• Not performing tuning
• Producing too many false positives
• Putting all signatures into block mode
• Not seeing East-West traffic
• Placing the sensor in the wrong place
• Not taking TLS traffic into account
• Not monitoring packet loss
• Leaving exceptions without a time limit
• Not sending alerts to the SIEM
• Not creating a SOC triage process
• Closing an incident because the IPS blocked it
• Not performing capacity planning

IDS/IPS Maturity Model

Level 1 - Basic Detection

Default signatures are used.

Level 2 - Tuned Detection

False positive tuning is performed.

Level 3 - Prevention

Critical attack signatures are blocked.

Level 4 - Context-Aware Detection

IDS/IPS is integrated with the SIEM, threat intelligence and asset context.

Level 5 - Behavior + Signature Detection

Signature, anomaly, NDR and automated response are used together.

Frequently Asked Questions

What is IDS?

IDS is the Intrusion Detection System technology that detects suspicious attack behaviour inside network or system activity.

What is IPS?

IPS is the Intrusion Prevention System technology that can detect attacks and block them on the network traffic.

What is the difference between IDS and IPS?

IDS is detection focused. IPS can perform prevention as well as detection.

What is NIDS?

Network Intrusion Detection System is the type of IDS that analyzes network traffic.

What is NIPS?

Network Intrusion Prevention System is the type of IPS that can block attacks detected inside network traffic.

What is Signature-Based Detection?

It is the matching of known attack patterns with predefined signatures.

What is Anomaly Detection?

It is the detection of activities different from normal network behaviour.

What is a False Positive?

It is normal traffic being perceived as an attack.

What is a False Negative?

It is a real attack not being detected.

What is IPS Tuning?

It is the optimization of IPS detection and prevention policies according to the organization's environment.

What is Virtual Patching?

It is the blocking of exploit attempts through a network security control until the patch is applied.

Does IDS/IPS detect Zero-Day attacks?

Signature-only detection is not always sufficient. Anomaly and behavioural detection must be added.

What is the difference between IDS/IPS and NDR?

While IDS/IPS mostly focuses on signature and packet inspection, NDR can use broader network telemetry and behavioural analytics.

Conclusion: The Firewall Permits the Traffic, IDS/IPS Questions Whether the Traffic Is Malicious

The firewall's fundamental question:

"Should this network connection be permitted?"

The fundamental question of IDS/IPS, on the other hand:

"Is there an attack inside this connection?"

These two security controls are not alternatives to each other.

They work together.

The modern network security model:

Access Control

Threat Detection

Threat Prevention

requires this approach.

For this reason:

Firewall

↓

IDS/IPS

↓

NDR

↓

SIEM

↓

SOC

are security layers that complement one another.

The real value of IDS/IPS systems emerges not with the installation of the device;

but with the correct design of the visibility, tuning, monitoring and response processes.

The default IPS policy is not sufficient on its own.

Because every organization's:

Network traffic

Applications

Critical assets

Risk profile

are different.

A sound intrusion prevention lifecycle can be thought of in this way:

Observe → Detect → Tune → Validate → Prevent → Monitor

In the first stage the traffic is analyzed.

Then the real threat patterns are identified.

False positives are reduced.

Critical attack signatures are put into block mode.

And the detection performance is monitored continuously.

In modern attacks signature-based detection is still important.

However, it is not sufficient on its own.

Because attackers:

Obfuscation

Encryption

Living-off-the-Land

Custom Malware

Zero-Day Exploit

may try to escape static signatures with methods such as these.

For this reason the network detection model of the future:

Signature + Behavior + Context + Threat Intelligence

is being built on this.

As a result, a strong Network Intrusion Detection approach is not merely:

"Catching the attack signature"

it is not this;

it is understanding the normal behaviour on the network and noticing the activities that fall outside that behaviour as early as possible.