IDS Basics If you aren’t already running network IDS, you should be. There are two types of Network IDS: Signature Detection & Anomaly Detection In a signature-based IDS, there are rules or patterns of known malicious traffic that it is looking for. Once a match to a signature is found it generates an alert. T hese alerts can turn up issues such as malware, scanning activity, attacks against servers and much more. With anomaly-based IDS, the payload of the traffic is far less important than the activity that generated it. An anomaly-based IDS tool relies on baselines rather than signatures. It will look for unusual activity that deviates from statistical averages of previous activities or activity that has been previously unseen. Perhaps a server is sending out more HTTP activity than usual or a new host has been seen inside your DMZ. Both are typically deployed in the same manner, though one could make the case you could easily (and people have) create an anomaly-based IDS on ext