Guide to Intrusion Detection and Prevention (IDP) Systems (Draft) - Special Publication 800-94

GuidanceNational Institute of Standards and Technology (NIST)Information Security

Intrusion detection is the process of monitoring the events occurring in a computer system or network and analyzing them for signs of potential incidents, which are violations or imminent threats of violation of computer security policies, acceptable use policies, or standard security practices. Intrusion prevention is the process of performing intrusion detection and attempting to stop detected potential incidents. Intrusion detection and prevention (IDP) systems are primarily focused on identifying potential incidents, logging information about them, attempting to stop them, and reporting them to security administrators. In addition, organizations use IDPs for other purposes, such as identifying problems with security policies, documenting existing threats, and deterring individuals from violating security policies. IDPs have become a necessary addition to the security infrastructure of nearly every organization.

IDPs typically record information related to observed events, notify security administrators of important observed events, and produce reports. Many IDPs can also respond to a detected threat by attempting to prevent it from succeeding. They use several response techniques, which involve the IDP stopping the attack itself, changing the security environment (e.g., reconfiguring a firewall), or changing the attack’s content.

> Read entire regulation (log in required - registration is free)