Hardware or software product that gathers and analyzes information from various areas within a computer or a network to identify possible security breaches, which include both intrusions (attacks from outside the organizations) and misuse (attacks from within the organizations.) (CNSSI-4009) (NISTIR) (Host-Based) IDSs which operate on information collected from within an individual computer system. This vantage point allows host-based IDSs to determine exactly which processes and user accounts are involved in a particular attack on the Operating System. Furthermore, unlike network-based IDSs, host-based IDSs can more readily "see" the intended outcome of an attempted attack, because they can directly access and monitor the data files and system processes usually targeted by attacks. (SP 800-36; CNSSI-4009) (NISTIR) (Network-Based) IDSs which detect attacks by capturing and analyzing network packets. Listening on a network segment or switch, one networkbased IDS can monitor the network traffic affecting multiple hosts that are connected to the network segment. (SP 800-36; CNSSI-4009) (NISTIR)
Understand more election terms clearly
Get one important election term explained each week, with authoritative sources, practical context and related definitions.
Hardware or software product that gathers and analyzes information from various areas within a computer or a network to identify possible security breaches, which include both intrusions (attacks from outside the organizations) and misuse (attacks from within the organizations.) (CNSSI-4009) (NISTIR) (Host-Based) IDSs which operate on information collected from within an individual computer system. This vantage point allows host-based IDSs to determine exactly which processes and user accounts are involved in a particular attack on the Operating System. Furthermore, unlike network-based IDSs, host-based IDSs can more readily "see" the intended outcome of an attempted attack, because they can directly access and monitor the data files and system processes usually targeted by attacks. (SP 800-36; CNSSI-4009) (NISTIR) (Network-Based) IDSs which detect attacks by capturing and analyzing network packets. Listening on a network segment or switch, one networkbased IDS can monitor the network traffic affecting multiple hosts that are connected to the network segment. (SP 800-36; CNSSI-4009) (NISTIR)
Cite this term
Election Security Glossary. (2026). Intrusion Detection Systems (ids). In Election Security Glossary. Retrieved August 21, 2026, from https://electionsecurityglossary.com/glossary/intrusion-detection-systems-ids
Sources
01
Single-source
Get the weekly election term
Receive one cited, source-backed election explanation in your inbox each week.