COMP 6660 · Enterprise Cybersecurity IDS, IPS, and Threat Detection

00 Introduction

Lesson 4.5 examined the controls that determine what traffic is permitted across boundaries. This lesson examines the controls that identify the attacks those controls did not stop — the detection technologies that provide the second half of the defence-in-depth principle.

Defence-in-depth (Lesson 4.2) assumes that any control can fail. Firewalls can be bypassed; segmentation can be crossed; authentication can be defeated; patches can be delayed. When prevention fails — as it inevitably will — detection is what determines how quickly the enterprise identifies the intrusion and how much harm the adversary can do before being stopped. Detection is the layer that reduces dwell time — the period between compromise and identification — and dwell time is one of the strongest determinants of incident severity.

Detection has evolved substantially over the past three decades. From network intrusion detection systems in the 1990s, to host-based detection on endpoints in the 2000s, to cloud-native and identity-focused detection in the present, the detection ecosystem has expanded to cover the whole enterprise estate. Intrusion detection systems (IDS) and intrusion prevention systems (IPS) remain the foundational technologies, but they now sit within a broader ecosystem that includes endpoint detection and response (EDR), network detection and response (NDR), cloud detection, and identity analytics.

This lesson examines threat detection in detail. It establishes why detection matters. It examines the IDS and IPS categories and their distinctions. It examines the principal detection approaches — signature, anomaly, behavioural, and heuristic. It examines detection at multiple layers — network, host and endpoint, cloud, and identity. It examines deployment and placement decisions. It examines detection engineering and tuning as an operational discipline. It examines the limitations of detection and the evasion techniques adversaries use. And it closes with enterprise practice and the pitfalls that recur across organisations.

01 Learning objectives

By the end of this lesson you should be able to:

These objectives contribute to Unit 4 outcomes U4.2 (technology evaluation) and U4.3 (control recommendation), and to Module 2 outcomes M2.6 and M2.7. See the Unit 4 learning outcomes page for the full mapping.

02 Why detection matters

Detection is the layer of defence that identifies attacks that prevention has not stopped. Its importance derives from a simple and unavoidable fact: prevention will sometimes fail.

The evolution of detection

Detection has evolved in step with the enterprise estate and the adversary:

• Network intrusion detection (1990s). Detection based on network traffic analysis — signature matching against known attacks. Focused on the perimeter, where attacks were expected to originate.
• Host-based detection (2000s). Detection on individual systems — file integrity monitoring, log analysis, host-based IDS. Complemented network detection with visibility into endpoint activity.
• Endpoint detection and response (2010s). Endpoint detection and response platforms that monitor endpoint behaviour continuously, detect anomalies, and enable investigation and response.
• Cloud and identity detection (2010s–2020s). Detection of cloud activity (API calls, configuration changes) and identity activity (authentication, access patterns) — the layers that have become the primary control plane.
• Integrated detection and response (2020s). XDR — extended detection and response — integrating telemetry from endpoints, networks, cloud, and identity into a single detection and response platform. Examined in Lesson 4.7.

03 IDS and IPS

Intrusion detection systems (IDS) and intrusion prevention systems (IPS) are the foundational detection technologies. Both monitor network traffic or system activity for signs of attacks; they differ in how they respond to what they detect.

IDS — Intrusion Detection Systems

An IDS monitors activity and generates alerts when it detects suspicious activity. It is a passive control — it observes and reports but does not block. Its output is alerts, which feed into the enterprise's incident response process.

• Monitoring. The IDS examines traffic, logs, or system activity for signs of attack — signatures of known attacks, anomalies in behaviour, indicators of compromise.
• Alerting. When it detects something suspicious, the IDS generates an alert — providing the information the enterprise needs to investigate.
• Logging. The IDS logs its observations — the traffic or activity it examined, the alerts it generated, the context of each detection.
• Reporting. The IDS provides reporting — summaries of detections, trends over time, and visibility into the enterprise's threat landscape.

IDS is well-suited to contexts where blocking is undesirable — where the risk of blocking legitimate traffic is high, where the enterprise wants to understand what is happening before taking action, or where the enterprise is building detection capability before deploying prevention.

IPS — Intrusion Prevention Systems

An IPS monitors activity and blocks suspicious activity in real time. It is an active control — it observes and blocks. It sits in-line in the traffic path, so that it can prevent traffic from reaching its destination when it detects malicious content.

• In-line deployment. The IPS sits in the traffic path — traffic passes through the IPS, which can block it if it detects malicious content.
• Real-time blocking. When it detects malicious activity, the IPS blocks it — preventing the attack from succeeding.
• Alerting and logging. Like an IDS, the IPS generates alerts and logs its observations — supporting investigation and improvement.
• Prevention at the network level. IPS provides a prevention control at the network layer — complementing firewalls with detection-based blocking.

IPS is well-suited to contexts where the enterprise wants to prevent attacks in real time — where the risk of permitting malicious traffic outweighs the risk of blocking legitimate traffic. But IPS deployment has trade-offs: it must operate in-line, adding latency; it must be highly reliable, since a failure affects traffic; and it requires careful tuning to avoid blocking legitimate traffic.

IDS versus IPS

The evolution beyond IDS and IPS

The IDS and IPS categories remain foundational, but the detection ecosystem has expanded well beyond them:

• EDR (Endpoint Detection and Response). Continuous monitoring and response on endpoints — beyond what traditional host-based IDS provides.
• NDR (Network Detection and Response). Continuous monitoring and analysis of network traffic — beyond what traditional network IDS provides.
• XDR (Extended Detection and Response). Integration of telemetry from multiple layers — endpoint, network, cloud, identity — into a single detection and response platform. Examined in Lesson 4.7.
• Cloud detection. Detection of cloud activity — API calls, configuration changes, unusual resource creation — using cloud provider tools and third-party platforms.
• Identity detection. Detection of identity-related anomalies — unusual authentication, unusual access patterns, credential abuse — using identity analytics platforms.
• Deception technologies. Honeypots, honeytokens, and other deception mechanisms that detect adversaries by luring them into behaviour that reveals their presence.

Modern detection architectures typically combine multiple technologies — network, endpoint, cloud, identity — to provide coverage across the enterprise estate. No single technology provides complete detection; the combination provides coverage that none of them provides alone.

04 Detection approaches

Detection technologies use several approaches to identify attacks. Each has different strengths, weaknesses, and appropriate uses. Modern detection architectures typically combine multiple approaches.

Signature-based detection

Signature-based detection matches observed activity against signatures — patterns that characterise known attacks. When the observed activity matches a signature, the detection fires.

• Strengths. High accuracy for known attacks; low false positive rate; easy to understand and explain; efficient for known threats.
• Weaknesses. Cannot detect unknown attacks; fails against custom malware and novel techniques; signature databases must be updated continuously; adversaries can modify their tools to evade signatures.
• Typical use. Antivirus; network IPS; detection of known malware and exploits.

Anomaly-based detection

Anomaly-based detection establishes baselines of normal activity and identifies deviations. When the observed activity deviates significantly from the baseline, the detection fires.

• Strengths. Can detect unknown attacks — activity that is anomalous, even if it does not match a known signature; adapts to the enterprise's specific environment.
• Weaknesses. Higher false positive rate — deviations from baseline occur frequently for legitimate reasons; requires established baselines, which take time to develop; can be evaded by adversaries who mimic normal behaviour.
• Typical use. Network behavioural analysis; user and entity behaviour analytics (UEBA); detection of novel attacks.

Behavioural detection

Behavioural detection identifies activity based on what it does rather than on what it looks like. Behavioural detection focuses on the sequence of actions — process creation, file modification, network connection — rather than on individual signatures.

• Strengths. Detects attacks that do not match signatures — including custom malware and living-off-the-land techniques; focuses on what attackers do rather than on what they use; effective against adversary adaptation.
• Weaknesses. Requires comprehensive visibility into system activity; sophisticated adversaries may mimic legitimate behaviour; requires skilled analysts to interpret detections.
• Typical use. EDR; detection of living-off-the-land techniques; detection of post-compromise activity.

Heuristic detection

Heuristic detection uses rules and reasoning to identify suspicious activity — patterns that are characteristic of malicious activity, even when the specific attack is not known. Heuristics are between signature and behavioural detection — they use rules but are not limited to matching known signatures.

• Strengths. Broader coverage than signature detection; can detect some variants of known attacks; simpler than behavioural detection.
• Weaknesses. Higher false positive rate than signatures; less general than behavioural detection; still relies on rules that adversaries can evade.
• Typical use. Email filtering; web filtering; detection of common attack patterns.

Deception-based detection

Deception-based detection uses decoy systems, data, or credentials to lure adversaries into behaviour that reveals their presence. Because legitimate users should not interact with deception mechanisms, any interaction is highly suspicious.

• Strengths. Very high confidence — interactions with deception mechanisms are almost always malicious; low false positive rate; detects adversaries that other approaches miss.
• Weaknesses. Requires deployment and maintenance of deception mechanisms; sophisticated adversaries may identify and avoid them; limited to contexts where deception can be deployed.
• Typical use. Honeypots, honeytokens, canary files, decoy credentials.

Detection approaches compared

Combining approaches

Modern detection architectures combine multiple approaches — exploiting the strengths of each while compensating for their weaknesses. A typical combination includes:

• Signature detection for known attacks. High accuracy for the large volume of known threats — filtering out most of the noise so that analysts can focus on what matters.
• Behavioural detection for post-compromise activity. Detecting the behaviours that adversaries exhibit once they have a foothold — lateral movement, privilege escalation, credential access.
• Anomaly detection for novel activity. Detecting what does not fit established patterns — the activity that is genuinely unusual.
• Deception for high-confidence signals. Deploying deception mechanisms that provide near-certain indicators when interacted with.

05 Network detection

Network detection examines network traffic for signs of attack. It is the original form of intrusion detection and remains a foundational component of the enterprise detection architecture.

What network detection provides

• Visibility into network activity. Network detection sees the traffic that crosses the network — what is connecting to what, over which protocols, with what content.
• Detection of network-based attacks. Exploitation of network services, network reconnaissance, denial-of-service, and command-and-control traffic are detected at the network layer.
• Detection of patterns across systems. Network detection sees the whole network — allowing detection of patterns that span multiple systems, such as lateral movement or coordinated attacks.
• Retrospective analysis. Recorded network traffic can be analysed after the fact — supporting investigation and enabling retroactive detection of new threats.

Network detection technologies

Network detection challenges

• Encryption. As traffic has become predominantly encrypted, network detection can no longer see the content of most traffic. Detection must rely on metadata, flow analysis, and — where appropriate — TLS inspection.
• Volume. Modern enterprise networks carry vast volumes of traffic. Network detection must process this volume efficiently to provide timely alerts.
• Distributed estates. The enterprise estate is distributed — cloud environments, remote users, SaaS services. Network detection traditionally deployed at the perimeter does not see traffic that does not traverse the enterprise network.
• East–west traffic. Internal traffic — between workloads and services — is invisible to perimeter network detection. Internal sensors or host-based detection are required.
• Performance. Full packet capture and inspection require substantial resources; not all network traffic can be inspected at line rate in all environments.
• Detection tuning. Network detection requires significant tuning to reduce false positives and focus on the enterprise's actual threats.

Network detection in the modern enterprise

Network detection remains essential, but its role has evolved:

• From perimeter to everywhere. Network detection is deployed not only at the perimeter but within the estate — at segment boundaries, in cloud environments, and on critical network paths.
• From signatures to behaviour. With encryption limiting content inspection, network detection has shifted toward behavioural analytics — detecting patterns in metadata and flow rather than matching content signatures.
• From standalone to integrated. Network detection is increasingly integrated with other detection layers — endpoint, cloud, identity — into combined platforms that provide holistic visibility.
• From detection to response. Network detection platforms increasingly include response capabilities — the ability to isolate systems, block traffic, and contain incidents.

06 Host and endpoint detection

Host and endpoint detection examines activity on individual systems — servers, workstations, and mobile devices. It provides the visibility that network detection cannot — what is happening within systems, beyond what their network traffic reveals.

What host and endpoint detection provides

• Process-level visibility. What processes are running, what they are doing, and how they interact — visible only at the endpoint.
• File and registry activity. Creation, modification, and access of files and registry keys — including the persistence mechanisms that malware uses.
• Memory analysis. What is loaded in memory — including fileless malware and in-memory attacks that leave no file-based indicators.
• System configuration changes. Modifications to system configuration — including the changes that attackers make to disable security controls or establish persistence.
• User activity. What users are doing on the endpoint — file access, application usage, command execution.
• Encrypted traffic visibility. Host-based detection can see activity before encryption and after decryption — providing visibility into encrypted communication that network detection cannot.

Host and endpoint detection technologies

EDR in depth

EDR (Endpoint Detection and Response) has become the dominant form of host-based detection in modern enterprises. EDR platforms combine:

• Continuous monitoring. EDR monitors endpoint activity continuously — process execution, file activity, network connections, registry changes, and more.
• Behavioural detection. EDR detects malicious behaviour — not just known malware signatures — including living-off-the-land techniques and novel attacks.
• Investigation capability. EDR provides the tools to investigate detections — examining the sequence of activity, the affected systems, and the scope of a potential compromise.
• Response capability. EDR can respond to incidents — isolating endpoints, terminating processes, removing malicious files, and enabling remediation.
• Threat hunting support. EDR data supports proactive hunting — allowing analysts to search for evidence of compromise across the endpoint fleet.

EDR has become central to enterprise detection because endpoints are where most activity occurs. The endpoint is where the user works, where the attacker establishes their foothold, and where much of the malicious activity happens. EDR provides visibility into this activity — and the capability to respond.

Host and endpoint detection challenges

• Coverage. EDR requires an agent on every endpoint. Unmanaged devices, legacy systems, and systems where agents cannot be deployed leave gaps in coverage.
• Agent management. Managing EDR agents at scale — deployment, updates, configuration, troubleshooting — is a substantial operational effort.
• Performance. EDR agents consume resources on endpoints. Performance impact must be managed — particularly on constrained devices.
• Privacy. EDR provides deep visibility into endpoint activity — raising privacy considerations that require governance.
• Alert volume. EDR platforms generate substantial alert volumes. Triage and investigation require skilled analysts and effective prioritisation.
• Adversary evasion. Sophisticated adversaries have developed techniques to evade EDR — including tampering with agents, exploiting kernel-level vulnerabilities, and using signed binaries for malicious purposes.

07 Cloud and identity detection

Cloud and identity detection are the newer components of the enterprise detection architecture — reflecting the shift of enterprise workloads to cloud environments and the rise of identity as the primary control plane.

Cloud detection

Cloud detection examines activity in cloud environments — API calls, configuration changes, resource creation and deletion, and unusual access. Cloud detection is essential because the majority of enterprise workloads now run in cloud environments, and because cloud activity frequently does not traverse the enterprise network.

Cloud detection monitors:

• Cloud API activity. Calls to the cloud provider's management APIs — creating resources, modifying configurations, changing identity policies. Cloud APIs are the primary control plane in cloud environments; unusual API activity is frequently the first indicator of compromise.
• Identity activity in the cloud. Authentication events, access patterns, and privilege use — the identity activity within cloud environments.
• Resource activity. Creation, modification, and deletion of cloud resources — including the resources adversaries create for command-and-control, data exfiltration, or cryptomining.
• Data access activity. Access to cloud storage, databases, and services — including unusual access patterns that may indicate exfiltration.
• Configuration changes. Modifications to security configurations — including the changes that adversaries make to disable logging or weaken controls.
• Compliance and posture. Deviations from security baselines and compliance requirements — misconfigurations, public storage, excessive permissions.

Identity detection

Identity detection examines identity-related activity — authentication, access patterns, privilege use — for signs of compromise or misuse. Identity detection is essential because identity is the primary control plane in modern enterprise security, and because compromised credentials are the most common initial access vector.

Identity detection monitors:

• Authentication events. Successful and failed authentication — including unusual authentication (unexpected locations, unusual times, unusual devices) that may indicate credential compromise.
• Privilege use. Use of privileged accounts — including unusual privilege use that may indicate privilege escalation or misuse.
• Access patterns. What users access — including unusual access that may indicate compromised credentials or insider activity.
• Identity changes. Creation, modification, and deletion of identities — including the changes that adversaries make to establish persistence or escalate privilege.
• Credential activity. Password changes, MFA configuration changes, and credential-related events — including the changes that adversaries make to maintain access.
• Session activity. Session establishment, duration, and termination — including anomalies that may indicate session hijacking or abnormal access.

Cloud and identity detection technologies

Cloud and identity detection challenges

• Integration complexity. Cloud and identity detection require integration with cloud providers, identity providers, and other systems — substantial engineering effort.
• Data volumes. Cloud environments generate large volumes of API and resource activity; identity systems generate large volumes of authentication and access events.
• Noise. Cloud and identity activity frequently includes legitimate anomalies — new services, new users, new access patterns — producing noise that must be filtered.
• Tool proliferation. The detection ecosystem for cloud and identity includes many specialised tools; integration and consolidation are challenges.
• Skills. Cloud and identity detection require skills that are different from traditional network and endpoint detection — adding to the skills challenge that enterprises face.

08 Deployment and placement

Detection is only effective when it is deployed where the relevant activity occurs. Deployment and placement determine what the detection sees — and what it does not.

Placement principles

Deployment models

Deployment considerations

• Coverage completeness. The deployment should provide coverage across the estate — all endpoints, all network segments, all cloud environments, all identity systems. Coverage gaps are detection gaps.
• Performance impact. Detection has performance implications — network sensors add latency; endpoint agents consume resources; cloud and identity detection consume API quotas. Impact must be managed.
• Integration. Detection from different layers must be integrated — so that correlated activity across layers produces unified detections rather than separate alerts.
• Data retention. Detection data — logs, network traffic, endpoint telemetry — should be retained for sufficient periods to support investigation and retrospective analysis.
• Privacy and compliance. Detection may involve monitoring of employee activity, content of communications, and other sensitive data. Privacy considerations must be addressed.
• Alert management. Detection generates alerts; deployment decisions determine alert volumes. Alert management — triage, prioritisation, escalation — must be designed alongside detection.
• Redundancy. Detection should not depend on a single sensor, agent, or integration. Redundancy ensures detection continues when components fail.

09 Detection engineering and tuning

Detection technology is only as good as the detection content that runs on it — the rules, analytics, and models that determine what the technology actually detects. Detection engineering is the discipline of designing, implementing, testing, and maintaining detection content.

What detection engineering involves

• Translating threat intelligence into detections. Converting information about adversary techniques and behaviour into detection rules — so that the enterprise detects what its actual adversaries do.
• Designing detections for the enterprise's environment. Detections that work in one environment may not work in another. Detection engineering customises detections for the enterprise's specific technologies, configurations, and activity patterns.
• Testing detections. Detections should be tested against known-good and known-bad activity — to verify that they detect what they should and do not produce excessive false positives.
• Maintaining detections. Detections decay — as adversary techniques change, as the enterprise's environment changes, as false positive rates fluctuate. Detection engineering maintains detections over time.
• Improving detection coverage. Identifying gaps in detection coverage — techniques the enterprise does not detect — and developing detections to close them.
• Measuring detection effectiveness. Using metrics — coverage, false positive rates, mean time to detect — to assess detection programme performance and identify improvement opportunities.

Detection content sources

Detection content comes from several sources:

• Vendor-provided content. Detection technologies frequently include built-in detection content — signatures, rules, and models provided by the vendor. This is the starting point for most enterprises.
• Community content. Open-source detection rules and analytics — from Sigma, from detection engineering communities, from open-source projects — provide detections that enterprises can adapt.
• Threat intelligence-driven content. Detection content developed from threat intelligence — information about the specific adversaries, techniques, and infrastructure that the enterprise faces.
• Enterprise-specific content. Detection content developed for the enterprise's specific environment — its technologies, its activity patterns, its threats — developed by the enterprise's detection engineering team.
• Hunting-derived content. Detections developed from threat hunting findings — when a hunt discovers a technique that was not detected, that finding drives new detection content.
• Incident-derived content. Detections developed from incidents — when an incident reveals a technique that was not detected, that incident drives new detection content.

Detection tuning

Detection tuning is the process of adjusting detection content to reduce false positives while maintaining detection coverage. Tuning is necessary because:

• Default content produces false positives. Detection content developed for broad use produces false positives in the specific enterprise environment — where legitimate activity may resemble malicious activity.
• Environments change. What was a false positive last year may be a legitimate activity now; what was legitimate last year may be a false positive now.
• Alert fatigue is real. High false positive rates produce alert fatigue — analysts begin to ignore alerts, and genuine detections are missed.
• Tuning is a balance. Reducing false positives can also reduce detection coverage — over-tuned detections may miss real attacks. Tuning requires judgement.

Effective tuning involves:

10 Detection limitations and evasion

Detection is powerful but not perfect. Understanding its limitations — and the techniques adversaries use to evade detection — is essential to designing effective detection programmes and to responding to incidents that detection has not caught.

Detection limitations

Evasion techniques

Adversaries have developed techniques to evade detection. Understanding these techniques informs both detection design and defensive priorities.

The detection arms race

Detection and evasion are in a continuous arms race. As enterprises improve detection, adversaries develop new evasion techniques. As adversaries develop evasion techniques, enterprises improve detection. Neither side achieves permanent advantage; the enterprise's detection posture must be maintained and improved continuously to keep pace.

This has several implications:

• Detection must evolve continuously. Detection content developed last year may be ineffective against techniques developed this year. Detection engineering is an ongoing discipline, not a one-time deployment.
• Multiple detection approaches are necessary. No single detection approach defeats all evasion techniques. Behavioural detection, anomaly detection, deception, and other approaches provide coverage that signature detection alone cannot.
• Layered detection is essential. Detection at multiple layers — network, endpoint, cloud, identity — provides coverage that no single layer provides.
• Assume some attacks will not be detected. The enterprise should assume that some attacks will evade detection — and design response capabilities accordingly. Containment, recovery, and resilience matter even when detection fails.
• Continuous improvement is required. Detection programmes must be measured, reviewed, and improved continuously — through red teaming, purple teaming, incident review, and coverage assessment.

11 Enterprise practice and pitfalls

Enterprise detection programmes fail in predictable ways. Recognising the pitfalls accelerates improvement.

Pitfall 1 — Technology without tuning

Deploying detection technology without the effort to tune it to the enterprise's environment. Default detection content produces excessive false positives; analysts ignore the alerts; the programme produces noise without insight.

Mitigation: Invest in detection engineering. Tune detection content to the enterprise's environment. Review and improve continuously.

Pitfall 2 — Coverage gaps

Deploying detection in some parts of the estate but not others — leaving unmanaged endpoints, cloud environments, legacy systems, and other systems without detection coverage.

Mitigation: Assess coverage systematically. Identify gaps. Close them where feasible; compensate where not.

Pitfall 3 — Detection without response

Deploying detection capability without the response capability to act on what is detected. Detections are generated; nothing happens; the adversary operates undetected in practice.

Mitigation: Integrate detection with response. Ensure that detections are investigated and acted on. Build response capability alongside detection capability.

Pitfall 4 — Alert fatigue

Generating so many alerts that analysts cannot investigate them all — and begin to ignore them. Genuine detections are lost in the noise.

Mitigation: Reduce false positives through tuning. Prioritise alerts by severity and confidence. Automate triage where feasible.

Pitfall 5 — No threat hunting

Relying on detection systems to catch all attacks, without the capability to proactively search for undetected adversaries. APT activity frequently does not trigger alerts.

Mitigation: Build or engage threat hunting capability (Lesson 3.6). Hunt regularly, using threat intelligence and hypotheses to guide the search.

Pitfall 6 — Signature-only detection

Deploying only signature-based detection, without behavioural or anomaly detection. Signature detection misses novel attacks and living-off-the-land techniques.

Mitigation: Deploy multiple detection approaches — signature, behavioural, anomaly, deception. Combine approaches for coverage that none provides alone.

Pitfall 7 — Disconnected detection layers

Deploying network, endpoint, cloud, and identity detection separately, without integration. Correlated activity across layers is not detected; each layer operates in isolation.

Mitigation: Integrate detection across layers — through SIEM, XDR, or equivalent (Lesson 4.7). Correlate activity across layers to detect patterns that no single layer sees.

Pitfall 8 — No measurement or improvement

Deploying detection and not measuring its effectiveness. Coverage gaps, detection rates, and false positive rates are not tracked; improvement opportunities are missed.

Mitigation: Measure detection programme performance — coverage, detection rate, false positive rate, mean time to detect. Use metrics to identify improvement opportunities.

Pitfall 9 — Encryption blind spots

Encrypted traffic that cannot be inspected — limiting network detection visibility. The enterprise's detection sees less than it could.

Mitigation: Deploy TLS inspection where appropriate — with consideration of privacy and legal implications. Supplement network detection with endpoint detection that sees activity before encryption and after decryption.

Pitfall 10 — Over-reliance on detection

Treating detection as the primary defence, without sufficient investment in prevention. Detection is one layer of defence-in-depth, not a replacement for prevention.

Mitigation: Balance investment across prevention, detection, and response. Recognise that detection, like all controls, can fail.

12 Key concepts

The terms below are used throughout Unit 4. Capture them in your own words as you work through the lesson.

Intrusion detection system (IDS)

A detection technology that monitors activity and generates alerts on suspicious activity. A passive control — it observes and reports but does not block.

Intrusion prevention system (IPS)

A detection technology that monitors activity and blocks suspicious activity in real time. An active control — it sits in-line and can block traffic.

Signature-based detection

Detection that matches observed activity against signatures — patterns that characterise known attacks. High accuracy for known attacks; cannot detect unknown attacks.

Anomaly-based detection

Detection that establishes baselines of normal activity and identifies deviations. Can detect unknown attacks; produces higher false positive rates.

Behavioural detection

Detection that identifies activity based on what it does rather than on what it looks like — focusing on the sequence of actions. Effective against living-off-the-land techniques.

Heuristic detection

Detection that uses rules and reasoning to identify suspicious activity — broader than signature detection but less general than behavioural detection.

Deception-based detection

Detection using decoy systems, data, or credentials to lure adversaries into behaviour that reveals their presence. Very high confidence — interactions with deception mechanisms are almost always malicious.

Honeypot

A decoy system designed to attract adversaries and detect their activity. Any interaction with the honeypot is suspicious.

Honeytoken

A decoy credential, file, or data item designed to detect adversaries who access it. Any use of the honeytoken indicates possible compromise.

Network IDS (NIDS) / Network IPS (NIPS)

Network-level IDS and IPS — monitoring network traffic for suspicious activity. Deployed at network boundaries or within the network.

Host IDS (HIDS)

Host-level IDS — monitoring activity on individual systems for suspicious activity.

Endpoint Detection and Response (EDR)

Continuous monitoring of endpoint behaviour with detection, investigation, and response capabilities. The dominant form of host-based detection in modern enterprises.

Network Detection and Response (NDR)

Continuous monitoring, analysis, and response for network traffic — beyond traditional NIDS. Typically uses behavioural analytics.

Extended Detection and Response (XDR)

Integration of telemetry from multiple layers — endpoint, network, cloud, identity — into a single detection and response platform. Examined in Lesson 4.7.

Cloud Security Posture Management (CSPM)

Continuous assessment of cloud configurations against best practice and policy — detecting misconfigurations.

User and Entity Behaviour Analytics (UEBA)

Behavioural analysis of user and system activity — establishing baselines and detecting anomalies across users and systems.

Identity Threat Detection and Response (ITDR)

Detection and response for identity threats — including credential compromise, privilege escalation, and identity infrastructure attacks.

Detection engineering

The discipline of designing, implementing, testing, and maintaining detection content — the rules, analytics, and models that determine what detection technologies actually detect.

False positive

A detection that fires on legitimate activity. High false positive rates produce alert fatigue and reduce detection programme effectiveness.

False negative

An attack that is not detected. False negatives are inherent in detection; the enterprise should design for the assumption that some attacks will evade detection.

Alert fatigue

The tendency for analysts to ignore alerts when the volume of false positives is high. A primary challenge in detection programme management.

Mean time to detect (MTTD)

The average time between compromise and detection. A primary metric for detection programme effectiveness.

Living-off-the-land

The use of legitimate tools and capabilities for malicious purposes — no custom malware, no signatures to match. Requires behavioural detection.

Detection evasion

The techniques adversaries use to avoid detection — signature evasion, behavioural evasion, coverage exploitation, detection disablement, alert flooding, and living-off-the-land.

13 Activities

The activities below help you test your understanding and prepare for the unit discussion and Assignment 2. They are not graded, but completing them will substantially improve your preparation.

14 Self-check

Answer the questions below before moving to Lesson 4.7. If you cannot answer a question confidently, revisit the corresponding section.

15 Summary

This lesson has examined IDS, IPS, and threat detection — the technologies through which enterprises identify attacks that prevention has not stopped. The essential points are:

• Detection matters because prevention will fail. No prevention control is perfect; detection determines how quickly the enterprise identifies intrusions that prevention has not stopped, and therefore how much harm the adversary can do before being stopped.
• IDS and IPS are the foundational detection technologies. IDS monitors and alerts (passive); IPS monitors and blocks (active). Both remain important; both have evolved substantially beyond their original forms.
• Detection approaches include signature, anomaly, behavioural, heuristic, and deception-based. Each has strengths and weaknesses; effective programmes combine multiple approaches.
• Detection is deployed at multiple layers. Network detection (traffic analysis); host and endpoint detection (activity on systems); cloud detection (API activity, resource activity); identity detection (authentication, access patterns).
• Deployment and placement determine coverage. Detection must be deployed where relevant activity occurs — at trust boundaries, across all layers, in both directions, avoiding blind spots.
• Detection engineering is the discipline that determines what detection technologies actually detect. Designing, implementing, testing, and maintaining detection content; tuning to reduce false positives; improving coverage continuously.
• Detection has significant limitations. False positives; false negatives; encryption; volume; coverage gaps; novel attacks; analyst capacity. Detection is powerful but not perfect.
• Adversaries use evasion techniques. Signature evasion; behavioural evasion; coverage exploitation; detection disablement; alert flooding; living-off-the-land. Detection and evasion are in a continuous arms race.
• Common pitfalls recur. Technology without tuning; coverage gaps; detection without response; alert fatigue; no threat hunting; signature-only detection; disconnected detection layers; no measurement; encryption blind spots; over-reliance on detection.
• Detection is one layer of defence-in-depth. It works alongside prevention, response, and resilience. Detection failures should be planned for, not assumed away.

These ideas prepare for Lesson 4.7, which examines how detection is integrated and operationalised at enterprise scale — through SIEM, XDR, and security operations centre (SOC) practice.