Knowledge and behavior based IDS

The knowledge IDS is based on a database that recognizes the signature of previously identified vulnerabilities. In this case, it is of utmost importance that the structure has a policy of continuous updating of this database, to guarantee the continuity of security of the environment. What is not known cannot be protected.

Behavior

This IDS, on the other hand, analyzes traffic behavior and follows a standard line of normal system activity. If there are deviations from this pattern - with the possibility of being an intrusion - some actions can be taken, such as the temporary blocking of traffic or alarms for network operation centers (NOC / SNOC). In this way, the abnormality can be better investigated, released or permanently blocked.

Active and passive IDS 

Active
An active IDS is defined as one that is programmed to automatically block attacks or suspicious activities that are known to you, without any need for human intervention. Although it is an extremely interesting model, adequate standardization in protected environments is important in order to minimize false positives - for example, by blocking connections that are legitimate, thus causing inconvenience to the company.

Passive
A passive IDS, finally, monitors the traffic that passes through it and thus identifies potential attacks or abnormalities. Based on this, it ends up generating alerts for administrators and security teams - without affecting anything in the communication.

Mor info:   managed intrusion detection