OVERVIEW OF IDS CAPABILITIES FOR NETWORK TRAFFIC ANALYSIS - Storozenko, Vadym; Demianchuk, Bogdan; Kozlovska, Diana; Fesenko, Andrii (Science-based technologies, 2025)
Intrusion Detection Systems (IDS) play a key role in modern cybersecurity by detecting and preventing unauthorized access and malicious activities within computer networks. IDS solutions operate at both the network level (NIDS) and the host level (HIDS), analyzing network traffic, event logs, and system behavior to identify potential threats. This study examines existing IDS technologies, including signature-based, anomaly-based, and hybrid approaches to threat detection. A comparative analysis was conducted on widely used IDS solutions such as Zeek, Snort, Suricata, Security Onion, Wazuh, Cisco Secure IDS, and IBM QRadar.The research underscores the effectiveness of different IDS models in detecting cyber threats while addressing challenges, such as false positives, scalability, and adaptation to emerging attack patterns. It also discusses the importance of integrating IDS with other security measures to enhance threat detection and incident response capabilities.