System designed to monitor and respond to suspicious network or system activity by blocking traffic or stopping activity.
Can be implemented in networks for inspecting traffic or on Hosts for inspecting network traffic and system logs.
Detection techniques
Signature-based: match traffic against database of known exploits.Anomaly-based: detect deviation from normal activity.