Ubiquiti UniFi Intrusion Detection & Prevention (IDS/IPS)

Intrusion Detection (usually called Intrusion Detection System – IDS) is a cybersecurity mechanism that monitors computer systems or networks to detect suspicious or malicious activity and alert administrators.

I’ll explain this clearly in three parts:

1. What intrusion detection is
2. How it works and its types
3. How to enable or use it (in common environments)

What Is Intrusion Detection?

Intrusion detection is the process of identifying unauthorised, abnormal, or malicious actions on a system or network.

An IDS does not stop attacks by itself – its primary role is to detect and alert.

How Intrusion Detection Works

An IDS continuously monitors:

• Network traffic
• System logs
• File changes
• User behavior
• Running processes

It compares what it sees against known attack patterns or normal behavior baselines.

Detection Methods

1. Signature-based Detection

• Matches activity against known attack patterns (signatures)
• Very accurate for known threats
• Cannot detect new or unknown attacks

2. Anomaly-based Detection

• Learns what “normal” behavior looks like
• Flags deviations (e.g., unusual login times or traffic volume)
• Can detect new attacks but may generate false alarms

3. Hybrid Detection

• Combines both methods (most modern systems use this)

Types of Intrusion Detection Systems

A. Network-based IDS (NIDS)

• Monitors network traffic
• Detects attacks like port scanning, DDoS, malware traffic
• Installed on:
  • Network gateways
  • Firewalls
  • Switches (SPAN/mirror ports)

B. Host-based IDS (HIDS)

• Monitors a specific computer or server
• Watches:
  • File integrity
  • System calls
  • Logs
  • User activity

IDS vs IPS (Important Difference)

🔹 IDS = alert only
🔹 IPS = alert + block

Why Intrusion Detection Is Important

✅ Detects attacks early
✅ Helps meet security compliance requirements
✅ Provides visibility into network behavior
✅ Supports incident response and forensics

Without IDS, attacks may go unnoticed for months.