The detection of network anomalies

Network intrusion detection systems (IDSs) are not a new idea. They have been proposed since the earliest network attacks. IDS can be categorized into two major categories, based on their deployment: HIDS and NIDS. The following diagram illustrates a high-level overview of an IDS architecture:

HIDS

HIDS are able to collect and monitor computer systems (especially their internals) in order to give security analysts a deep visibility into what's happening on critical systems, such as workstations, servers, and mobile devices. The main goal of an HIDS is to detect intrusions.

NIDS

...