What is the difference between NIDS and HIDS?

What is the difference between NIDS and HIDS?

• A. NIDS monitors network traffic while HIDS monitors individual host systems
• B. HIDS monitors network traffic while NIDS monitors individual hosts
• C. NIDS uses encryption; HIDS uses hashing
• D. NIDS on hosts; HIDS on networks

Answer: (A)

The important idea here is where the monitoring happens: across the network or on a single machine. A network intrusion detection system watches the traffic flowing on a network segment. It analyzes packets, flow patterns, and protocol behavior to spot suspicious activity that could affect multiple hosts, often placed at a network chokepoint to see traffic from many devices. A host-based intrusion detection system, by contrast, runs on an individual host and monitors activity inside that machine. It looks at things like file integrity, system logs, user logins, process activity, and configuration changes to detect signs of compromise on that specific host. So, the correct difference is that NIDS handles network traffic across the network, while HIDS handles the activity on each separate host. The other descriptions mix up where monitoring occurs or rely on unrelated notions like encryption or hashing, which aren’t the defining distinction between NIDS and HIDS.

The important idea here is where the monitoring happens: across the network or on a single machine. A network intrusion detection system watches the traffic flowing on a network segment. It analyzes packets, flow patterns, and protocol behavior to spot suspicious activity that could affect multiple hosts, often placed at a network chokepoint to see traffic from many devices.

A host-based intrusion detection system, by contrast, runs on an individual host and monitors activity inside that machine. It looks at things like file integrity, system logs, user logins, process activity, and configuration changes to detect signs of compromise on that specific host.

So, the correct difference is that NIDS handles network traffic across the network, while HIDS handles the activity on each separate host. The other descriptions mix up where monitoring occurs or rely on unrelated notions like encryption or hashing, which aren’t the defining distinction between NIDS and HIDS.