What type of behavior does a host-based IDS look for?

A host-based Intrusion Detection System (IDS) is specifically designed to monitor and analyze activities on individual computers or hosts. The primary goal of a host-based IDS is to detect unauthorized access or abnormal behavior that may indicate a security threat.

Unusual process activity is a key indicator for a host-based IDS because it directly points to potential compromises within a host system. This includes unexpected execution of processes, attempts to access sensitive files, or modifications to critical system areas. By focusing on process activities, the IDS can identify malware activity, unauthorized software installations, or evasion tactics used by attackers.

Monitoring for unusual processes enables the system to catch various forms of intrusions, including zero-day exploits and insider threats, as these often manifest through abnormal behavior in processes running on the host. This capability is particularly important for maintaining the integrity and security of the host environment, making it the primary focus for a host-based IDS.