There are a variety of Intrusion Detection Systems in the market ranging from the enterprise-level managed-network monitoring solution to a simple on-the-host logging system. There is also a distinction between an Intrusion Prevention System (IPS) and an IDS. An IPS goes one better than the IDS and attempts to block an attack in progress whereas the IDS attempts to log the attack and optionally notify a responsible party to employ an incident response plan.

IDSs can be further categorized as NIDS or HIDS, the difference being that the former watches the network and the latter monitors the host. This is important when choosing an IDS as we have to be sure of what exactly we are monitoring.

For example, many administrators won't employ a HIDS on Windows or Unix boxes due to their built-in abilities to log extensively (event logs/syslog), and therefore prefer to monitor the traffic on the network for signs of malicious behavior. This can also be more reliable than host monitoring...