NIST Guide to Intrusion Detection and Prevention (IDP) Systems (DRAFT)

This publication describes the characteristics of IDP technologies and provides recommendations for designing, implementing, configuring, securing, monitoring, and maintaining them. There are many types of IDP technologies, which are differentiated primarily by the types of events that they monitor and the ways in which they are deployed. This publication discusses the following four types of IDP technologies:
- Network-Based, which monitors network traffic for particular network segments or devices and analyzes the network and application protocol activity to identify suspicious activity
- Wireless, which monitors wireless network traffic and analyzes it to identify suspicious activity involving the wireless networking protocols themselves
- Network Behavior Anomaly Detection (NBAD), which examines network traffic to identify threats that generate unusual traffic flows, such as DDoS attacks, scanning, and certain forms of malware
- Host-Based, which monitors the characteristics of a single host and the events occurring within that host for suspicious activity.

Read the guide in pdf format (2.3 MBs)