System designed to monitor and respond to suspicious network or system activity by generating alerts (but not blocking traffic or stopping activity like an IPS).
Can be implemented in networks for inspecting traffic or on Hosts for inspecting network traffic and system logs.
Detection techniques
Signature-based: match traffic against database of known exploits.Anomaly-based: detect deviation from normal activity.